Vulnerability · Published Jun 1, 2026 · Assigned by VulDB
CVE-2026-10219nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection
High 7.3
In plain English
A high-severity OS command injection in GoClaw from nextlevelbuilder. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/nextlevelbuilder/goclaw | no fix listed | GHSA-6jm8-4fhr-5w64 |
| Go | github.com/nextlevelbuilder/goclaw | no fix listed | GO-2026-5951 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nextlevelbuilder | GoClaw | 3.11.03.11.13.11.23.11.3 |
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-367498 | nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection vdb-entry, technical-description
- VDB-367498 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-10219 | CVE Analysis and Report third-party-advisory
- Submit #821939 | nextlevelbuilder goclaw <= v3.11.3 OS Command Injection (CWE-78) third-party-advisory
- https://github.com/nextlevelbuilder/goclaw/issues/1121 exploit, issue-tracking
- https://github.com/nextlevelbuilder/goclaw/pull/1155 issue-tracking, patch
- https://github.com/nextlevelbuilder/goclaw/ product