Executive brief
GoClaw is a platform used to deploy and manage AI agent teams. A security flaw in its command execution tool allows authorized users to bypass safety restrictions and run unauthorized commands on the underlying server. This could lead to data theft, unauthorized file changes, or full system compromise by bypassing the intended security allowlist.
Technical details
A policy bypass exists in GoClaw's `exec` tool due to a discrepancy between how commands are validated and how they are executed. The `ExecApprovalManager.CheckCommand` function in `internal/tools/exec_approval.go` validates only the initial command token (e.g., 'env') against an allowlist. However, the execution layer in `ExecTool.executeOnHost` passes the entire original, unparsed command string to `sh -c`. An authenticated attacker with operator privileges can exploit this by prefixing a malicious shell payload with an allowlisted wrapper, resulting in arbitrary command execution on the host.
Affected products
- nextlevelbuilder GoClaw <= 3.11.3
Timeline
- 2026-07-14: disclosed: Vulnerability published via VulDB and NVD