Executive brief
GoClaw is a platform for deploying AI agent teams with built-in security isolation. A vulnerability in the ACP ToolBridge component allows an AI agent to bypass its security sandbox and write files to the host system's restricted directories. This could allow an attacker to corrupt system files, modify data in other workspaces, or disrupt operations by overwriting critical configuration files.
Technical details
A path traversal vulnerability exists in the `writeFile` function within `internal/providers/acp/tool_bridge.go` of GoClaw. The root cause is a flaw in `resolvePath()` where `filepath.EvalSymlinks` is used for validation; if the function fails (e.g., on a dangling symlink), the code falls back to a lexical path check. An attacker can exploit this by first creating a dangling symlink pointing to a sensitive host location and then calling `fs/writeTextFile` on that path. Because the lexical check passes while the subsequent `os.WriteFile` follows the symlink, the attacker can write arbitrary content outside the sandbox. This requires the ability to issue ACP tool requests, typically available to an authenticated agent session.
Affected products
- nextlevelbuilder GoClaw 3.13.3-beta.3
Timeline
- 2026-07-14: disclosed: Vulnerability disclosed and CVE assigned