EUVD-2026-38464
GHSA-6373-p7g2-mx2w
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privileges required; scope change (S:C) because the agent escapes its outbox boundary to read host files; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only isSafeAttachmentName before copying with fs.copyFileSync, which follows symlinks without containment checks, allowing malicious agents to disclose arbitrary host files.
AnalysisAI
Symlink following in NanoClaw's agent-to-agent file forwarding exposes arbitrary host-readable files to container-controlled agents. All releases before 2.1.17 are affected; the forwardAttachedFiles function validated attachment filenames with isSafeAttachmentName but called fs.copyFileSync without first resolving symlinks or confirming the resolved path remained inside the agent's outbox directory. A low-privileged agent can craft a symlink with a safe-looking filename, point it at any host file readable by the NanoClaw process, and receive its contents forwarded as a message attachment. No public exploit is identified at time of analysis, though the VulnCheck advisory and GitHub PR diff provide sufficient detail for a technically capable attacker to reproduce exploitation.
Technical ContextAI
NanoClaw (cpe:2.3:a:nanocoai:nanoclaw) is an agent-to-agent orchestration platform that forwards file attachments between agent sessions via forwardAttachedFiles in src/modules/agent-to-agent/agent-route.ts. The root cause is CWE-59 (Improper Link Resolution Before File Access): fs.copyFileSync follows symbolic links by design, so any symlink placed in the source outbox directory is transparently dereferenced to its target before copying. The pre-patch code performed only a filename-safety check (isSafeAttachmentName) without calling fs.lstatSync to detect symlink file types or fs.realpathSync with a path-containment test. The fix introduces an isPathInside helper, rejects entries where lstatSync reports isSymbolicLink() === true on either the source directory or individual files, resolves real paths with realpathSync, and enforces that the resolved path falls within the expected outbox directory - addressing all layers of the path-traversal surface.
RemediationAI
Upgrade to NanoClaw 2.1.17 or later, which incorporates the symlink detection and path containment fix from PR #2468 (commit 28032bc0eca76c91fb3d8be0013e8bcaf2f5aeae); see https://github.com/nanocoai/nanoclaw/pull/2468. If immediate upgrade is not possible, restrict agent process filesystem permissions to the minimum required so that symlinks cannot be created pointing to sensitive host paths - note this may affect legitimate agent functionality. Alternatively, disable inter-agent file attachment forwarding at the application or network policy level if the feature is not operationally required; this eliminates the vulnerable code path entirely but removes legitimate file-sharing capability. Running the NanoClaw host process under a dedicated low-privilege user account with no access to secrets directories (e.g., /etc/ssh, credential stores) limits the blast radius should exploitation occur.
Path traversal in NanoClaw's container filesystem boundary allows compromised containers or prompt-injected agents to es
Privilege escalation in NanoClaw before 2.1.17 lets remote attackers with a valid questionId approve or reject privilege
Privilege escalation in NanoClaw before 2.1.17 allows confined agent containers to bypass their architectural confinemen
Link-following (symlink) handling in NanoClaw's agent-to-agent attachment forwarding lets an authenticated, low-privileg
Improper authorization in nanocoai NanoClaw's add_mcp_server endpoint allows authenticated attackers with low privileges
Improper privilege management in NanoClaw (versions up to 2.0.64) allows authenticated remote attackers to abuse the `ha
Improper authorization in NanoClaw's MCP Server Approval component allows local attackers to bypass security controls by
Privilege escalation in NanoClaw before 2.1.0 lets scoped admins cross agent-group authorization boundaries by submittin
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today