EUVD-2026-45391
GHSA-g37g-6895-qw74
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privilege access required; S:C reflects sandbox escape to host filesystem; I:L for limited arbitrary file write outside sandbox; no confidentiality or availability impact demonstrated.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue.
AnalysisAI
Symlink following in nearai ironclaw up to 0.29.1 allows a local low-privileged user to redirect the write_file built-in tool's output to arbitrary files outside the agent's sandbox directory. The root cause is that the validate_path function in src/tools/builtin/path_utils.rs used metadata resolution that follows symlinks rather than symlink_metadata, permitting a dangling symlink inside the sandbox to pass validation and cause the subsequent write to land on an out-of-sandbox target. No confirmed active exploitation (not in CISA KEV) but a public proof-of-concept is referenced at GitHub issue #4797, and EPSS data was not supplied.
Technical ContextAI
nearai ironclaw (CPE: cpe:2.3:a:nearai:ironclaw:*:*:*:*:*:*:*:*) is a Rust-based AI agent framework. CWE-59 (Improper Link Resolution Before File Access - Link Following) is the root cause class: the validate_path function in src/tools/builtin/path_utils.rs performed directory-traversal boundary checks but used std::fs::metadata (which follows symlinks transparently) instead of std::fs::symlink_metadata to inspect the resolved final path component. Consequently, a dangling symlink - one whose link entry exists inside the sandbox but whose target path does not yet exist on disk and resolves outside the sandbox - bypassed the path-containment check entirely. The write_file tool then created and populated the out-of-sandbox target file. The fix in commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 adds a symlink_metadata check that explicitly returns a NotAuthorized error when the final resolved path is detected as a symlink, blocking the escape. The fix and associated tests are gated under #[cfg(unix)], confirming the vulnerability is Unix/Linux-specific.
RemediationAI
Apply the upstream fix from GitHub pull request #4869 (commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255, available at https://github.com/nearai/ironclaw/commit/369ff3d240cf3c0787b50e1e9f182e1a06c71255). The exact patched release version is not independently confirmed from the available data - only the commit and PR are referenced, not a tagged release; users should build from the patched commit or monitor the upstream releases page for a versioned release containing the fix. As a compensating control prior to patching, restrict the OS-level permissions on the ironclaw sandbox directory so that only the ironclaw process owner can create files or symlinks within it, preventing an attacker from placing the malicious symlink in the first place. On Linux, running ironclaw within a container with a read-only host filesystem bind-mount or a seccomp/landlock profile that restricts symlink creation would also mitigate the attack path, though these controls add operational complexity and may interfere with legitimate agent workflows.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today