CVE-2026-18038

EUVD-2026-49794 LOW

Information Exposure (CWE-200)

2026-07-28 cna@vuldb.com

GHSA-r4xf-9fv3-cx9j

Information Disclosure

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 13:30 vuln.today

DescriptionCVE.org

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1230. It is advisable to implement a patch to correct this issue.

AnalysisAI

Remote information disclosure in nextlevelbuilder GoClaw up to version 3.13.2 allows authenticated low-privilege attackers to extract sensitive data from internal tool execution. The vulnerability is in the ExecTool.Execute function of the jq handler, and publicly available exploit code exists. Users are urged to patch via PR #1230 or upgrade to a fixed version when released.