Executive brief
GoClaw, a tool for deploying AI agent teams, contains a security flaw in how it validates commands before running them on a host server. When configured to only allow specific approved commands (an 'allowlist'), the system incorrectly checks only the name of the command rather than its full path. This allows an authorized user to trick the system into running a malicious file they have uploaded by giving it the same name as a trusted command, potentially leading to full control over the host server.
Technical details
A vulnerability exists in GoClaw's `internal/tools/exec_approval.go` within the `matchesAllowlist` and `extractBin` functions. When `tools.execApproval.security` is set to `allowlist`, the system uses `filepath.Base()` to extract the command name for validation. This creates an identity split where the approval layer validates a basename (e.g., 'echo'), but the execution layer runs the original user-supplied string (e.g., './echo') via `/bin/sh -c`. An authenticated operator can exploit this by placing a malicious binary with a trusted name in their workspace and invoking it via the `POST /v1/tools/invoke` endpoint. This results in arbitrary command execution with the privileges of the GoClaw host process.
Affected products
- nextlevelbuilder GoClaw <= 3.13.3-beta.3
Timeline
- 2026-07-18: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-07-18: advisory