Description

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T18:20:28.530Z",
  "pubdate": "2026-09-14T18:20:28.530Z",
  "executiveSummary": "A critical security vulnerability identified as improper link following exists within the NanoClaw Attachment Handler component.\nThis vulnerability affects NanoClaw versions up to 2.1.17 and resides in the forwardAttachedFiles function within the src/modules/agent-to-agent/agent-route.ts file.\nThe flaw enables remote attackers to manipulate file paths, potentially resulting in unauthorized file system access or traversal.\nThe risk is exacerbated by the public availability of an exploit, necessitating immediate remediation.\nSuccessful exploitation allows an unauthenticated or remote actor to direct the application to access unintended locations on the host file system by leveraging the insecure handling of attached files.\nGiven the remote exploitability and public proof-of-concept availability, this vulnerability poses a significant risk to the integrity and confidentiality of the host environment.",
  "technicalDetails": "The vulnerability is located in the Attachment Handler component of NanoClaw, specifically within the forwardAttachedFiles function defined in src/modules/agent-to-agent/agent-route.ts.\nThe root cause of the issue stems from an improper validation mechanism when processing attachments intended for inter-agent communication. The function fails to adequately sanitize or verify the target path of files being processed, allowing for a link following attack.\nIn this context, link following occurs when an application processes a file path that is either a symbolic link or a malicious path manipulated to point outside of the intended directory context.\nThe attack flow begins with a remote actor crafting a request containing a malicious attachment payload. By leveraging the insecure handling logic in forwardAttachedFiles, the attacker forces the application to follow a path or symbolic link that references arbitrary sensitive files on the host file system.\nBecause the function processes these attachments without enforcing strict path resolution constraints (such as chroot jails, canonicalization checks, or directory traversal filtering), the application executes read or move operations on files that the service account otherwise should not have accessed.\nThis vulnerability is classified as remote because the attacker does not require prior local access to the agent environment to trigger the vulnerable code path. The exploitability is further confirmed by the existence of a public exploit targeting this specific function and file path.\nPost-exploitation impact includes unauthorized reading of sensitive configuration files, credential exposure, or the potential for further system compromise depending on the permissions of the user running the NanoClaw process. The lack of input validation on the file path parameters creates a direct vector for file system manipulation, effectively bypassing logical boundaries between the agent's expected working directory and the broader host file system."
}