Log in Start free

Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90807nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

Medium 6.3

In plain English

A medium-severity security flaw in NanoClaw from nanocoai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 63.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

VendorProductVersions
nanocoai NanoClaw 2.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.7

Weakness: CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References