CVE-2026-10219: nextlevelbuilder GoClaw OS command injection in FsBridge.WriteFile

CVE-2026-10219 · Severity: high · CVSS 7.3 · Published 2026-06-01

GoClaw, a tool used for deploying AI agent teams with multi-tenant isolation, contains a vulnerability that allows for remote command execution. By manipulating file paths, an attacker can bypass security sandboxes to run unauthorized commands on the underlying system. This could lead to a complete compromise of the sandbox environment, potentially exposing customer data or allowing attackers to disrupt operations.

Technologies: Nextlevelbuilder GoClaw. Vendors: Go, Nextlevelbuilder.

Quick answers

Is CVE-2026-10219 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10219 being exploited in the wild.
How severe is CVE-2026-10219?
High severity, with a CVSS score of 7.3, published 1 June 2026.
Which products and versions are affected?
github.com/nextlevelbuilder/goclaw (Go) <= 3.11.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.11.3; Nextlevelbuilder GoClaw <= 3.11.3, up to 3.11.3.
Is there a fix for CVE-2026-10219?
A patch was published on 2026-05-19: Pull request #1155 submitted to fix the injection issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10219 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-10219?
Check whether you run github.com/nextlevelbuilder/goclaw (Go) or Nextlevelbuilder GoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in GoClaw's FsBridge.WriteFile function within `internal/sandbox/fsbridge.go`. The root cause is the insecure construction of a shell command using `fmt.Sprintf` to interpolate filenames into a `sh -c` execution string. While the `%q` verb was used for quoting, it fails to neutralize shell metacharacters like command substitutions `$(...)`. A remote attacker can provide a crafted filename containing these metacharacters to achieve arbitrary command execution as root within the sandbox container. A fix has been proposed in pull request #1155 which replaces the shell-based write path with a direct execution of `tee`, passing the filename as a discrete argument to avoid shell evaluation.

Affected products

  • nextlevelbuilder GoClaw <= 3.11.3

Identifiers

  • CVE-2026-10219
  • GHSA-6jm8-4fhr-5w64
  • GO-2026-5951

Timeline

  • 2026-05-19: patched: Pull request #1155 submitted to fix the injection issue.
  • 2026-06-01: disclosed: Vulnerability disclosed and CVE-2026-10219 assigned.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.