EUVD-2026-53701
GHSA-q94p-g4rh-r9rf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible send_file requires no authentication (PR:N); limited file read/write/disruption maps to L/L/L impact with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component send_file. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in nanocoai NanoClaw through version 2.0.64 allows remote unauthenticated attackers to escape the intended file system boundary via the send_file MCP tool, enabling unauthorized file read and potential file write operations on the host. A public proof-of-concept exploit has been disclosed via GitHub issue #2760, and the vendor has not responded to the responsible disclosure, leaving all deployments through the affected version without an available patch. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity remote exploitation with no special prerequisites required.
Technical ContextAI
NanoClaw is an AI agent runner framework implementing Model Context Protocol (MCP) tools, with the vulnerable component located in container/agent-runner/src/mcp-tools/core.ts within the send_file function. CWE-22 (Path Traversal) indicates that user-supplied path parameters passed to send_file are not properly validated, normalized, or canonicalized before file system operations are performed. This allows traversal sequences such as ../ to escape the intended working directory boundary. Such flaws are characteristically found in file-serving APIs that concatenate user input directly onto a base path without checking that the resolved path remains within the allowed root. The MCP tool architecture - designed to expose file operations to AI agents - amplifies the attack surface because file access is an intentional, exposed capability.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer had not responded to the disclosure as of reporting. Organizations running NanoClaw through version 2.0.64 should immediately assess whether the send_file MCP tool is operationally required; disabling or removing it eliminates the attack surface entirely, with the trade-off of losing that file transfer capability for agent workflows. If send_file must remain enabled, restrict network access to the agent-runner container port to trusted internal hosts only using firewall rules or Kubernetes NetworkPolicy, accepting reduced accessibility for external consumers. Apply strict filesystem permissions limiting the agent-runner process user to only the directories it legitimately requires, so that even a successful traversal yields access to a minimal file set. Monitor https://github.com/nanocoai/nanoclaw/ and the VulDB entry at https://vuldb.com/vuln/386367 for patch availability and upgrade immediately upon release.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today