NanoClaw CVE-2026-7875

Attacker must have code execution inside a NanoClaw container (PR:L in CVSS vector). This requires either: (1) deployment of a malicious agent binary in the container, (2) successful prompt injection attack against an AI agent to control message generation, or (3) compromise of an existing container process. The vulnerability affects NanoClaw deployments where containers have any ability to specify message_out.id values or content.files arrays in outbound messages. Exploitation requires no user interaction (UI:N) and is possible against default NanoClaw configurations with no special features enabled. Limiting factors: attack vector is local (AV:L) requiring prior container access rather than remote network exploitation; attack is limited to read access and deletion rather than arbitrary code execution on the host (though exfiltrated data or deleted directories may enable further attacks); detection is possible through filesystem monitoring of unexpected path access patterns outside session directories.

CVSS 9.3 (Critical) with local attack vector, low complexity, and low privileges required. Despite the critical score, real-world risk depends heavily on deployment context. The vulnerability requires the attacker to already have code execution inside a NanoClaw container (PR:L), making this a container escape rather than initial access. Attack complexity is low (AC:L) because exploitation requires only crafted JSON message values, easily achieved through prompt injection against an AI agent or by a malicious agent binary. The CVSS vector shows high impact across all CIA dimensions for both vulnerable (V) and subsequent (S) systems, reflecting the container-to-host escape scenario. EPSS data not provided, limiting real-world exploitation probability assessment. No CISA KEV listing indicates no confirmed widespread exploitation. The GitHub PR shows comprehensive test coverage for multiple attack vectors (path traversal in filenames, symlink following, unsafe message IDs, recursive deletion), suggesting the vendor identified all major variants. Primary risk is to multi-tenant NanoClaw deployments where untrusted agent code runs, or single-tenant systems vulnerable to prompt injection. Mitigating factor: exploitation requires prior container compromise, limiting attack surface compared to network-accessible vulnerabilities. Missing data: EPSS score, active exploitation reports, production deployment prevalence.

An attacker achieves code execution inside a NanoClaw container through prompt injection against an AI agent, causing it to generate a malicious outbound message with content.files set to ['../../../../etc/shadow']. When the host-side readOutboxFiles processes this message, it constructs a path outside the intended outbox directory and reads the sensitive file, returning contents to the container. In a destructive variant, the attacker supplies messages_out.id as '../../../../var/lib/important-data' and triggers outbox cleanup, causing the host to recursively delete the target directory. The source code test cases demonstrate both scenarios are exploitable with simple JSON payloads.