EUVD-2026-43616
GHSA-mmqr-fw76-fv3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable function requires low-privilege authentication; only limited confidentiality impact with no integrity or availability consequence, consistent with CWE-200.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used.
AnalysisAI
Information disclosure in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows remote low-privileged attackers to extract sensitive data by manipulating the args.targetUrl argument passed to the handleNavigate function in pkg/browser/tool.go. A public proof-of-concept exploit exists and is referenced via GitHub issue #1207, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.3. No confirmed patched release has been identified at the time of analysis, leaving all known versions of the product exposed.
Technical ContextAI
GoClaw, developed by nextlevelbuilder, is a Go-language tool with a browser automation or navigation component. The vulnerable code resides in pkg/browser/tool.go within the handleNavigate function, which processes a URL argument (args.targetUrl) without sufficient validation or sanitization. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the function either returns, logs, or reflects internal data when presented with a crafted URL - a pattern commonly associated with SSRF-adjacent leakage, path traversal in URL parsing, or improper error message exposure. The CPE string cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:* confirms all sub-versions up to 3.13.3-beta.3 are in scope. No CWE subcategory is specified beyond CWE-200, so the precise leakage mechanism (e.g., server-side request forgery disclosing internal responses, reflected file paths, or credential material in error output) must be inferred from the POC at GitHub issue #1207.
RemediationAI
No vendor-released patched version has been independently confirmed at the time of analysis - the available references point to a GitHub issue (#1207) rather than a tagged release or formal security advisory. Organizations should monitor the GoClaw repository at https://github.com/nextlevelbuilder/goclaw/ for a patched release and apply it immediately upon availability. As a compensating control, restrict access to GoClaw's browser navigation functionality to only trusted, authenticated users and enforce network-layer controls (firewall rules, API gateway authentication) to prevent exposure of the handleNavigate endpoint to untrusted networks. If GoClaw is not strictly required, disabling or removing the tool from internet-facing environments is the most effective interim mitigation. The trade-off of disabling the tool is loss of its browser automation capability; firewall restriction may still permit insider abuse if the PR:L condition is met internally. VulDB tracking is available at https://vuldb.com/vuln/378129.
OS command injection in nextlevelbuilder GoClaw through version 3.11.3 allows remote attackers to execute arbitrary shel
Missing authentication in GoClaw's Webhook Verification Handler allows unauthenticated remote attackers to interact with
Improper authorization in the GoClaw and GoClaw Lite RPC gateway allows unauthenticated remote attackers to invoke privi
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF bl
Path traversal in GoClaw 3.13.3-beta.3 allows authenticated remote attackers to read or write files outside the intended
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the bina
Incorrect authorization in nextlevelbuilder GoClaw's WebSocket RPC Handler allows authenticated low-privilege remote att
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remot
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attacke
Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.vid
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today