Executive brief
mosaxiv clawlet is an AI assistant that includes tools for managing files within a specific restricted workspace. A security flaw allows a local user to bypass these restrictions by using hardlink aliases, which are special file shortcuts that point to the same data on a disk. By creating a link inside the workspace that points to a file outside of it, an attacker can read or modify sensitive system files that should be protected, potentially leading to data theft or unauthorized system changes.
Technical details
A vulnerability exists in the File Tools component of mosaxiv clawlet (specifically within tools/fs_ops.go) due to improper link resolution. While the application implements checks against symbolic link traversal and absolute paths to enforce workspace restrictions, it fails to verify if a file is a hardlink alias to an inode located outside the workspace. A local attacker can create a hardlink inside the workspace pointing to a sensitive file on the same filesystem. When the 'read_file', 'write_file', or 'edit_file' functions are called on this link, the application performs the operation on the external file, bypassing the 'restrictToWorkspace' security boundary. The vendor has marked this issue as 'not planned' for fixing.
Affected products
- mosaxiv clawlet up to 0.2.10
Timeline
- 2026-07-14: advisory: NVD publication date
- 2026-07-13: disclosed: Initial disclosure via VulDB and GitHub issue