Executive brief
JunoClaw is an AI platform that interacts with the Juno blockchain network. A security flaw in its file upload tool allowed the AI agent to access and upload any file from the host computer's filesystem without restriction. An attacker could exploit this to steal sensitive local data, such as private keys or configuration files, by tricking the system into uploading them to the public blockchain.
Technical details
The `upload_wasm` MCP tool in JunoClaw's `cosmos-mcp` package accepted arbitrary filesystem paths from the agent without validating the file location, size, or format. This vulnerability stems from improper input validation (CWE-20) and path traversal (CWE-22), where the tool would resolve and upload any file the path pointed to, including those outside the intended directory. Attackers could use symlinks (CWE-59) to exfiltrate sensitive files from the operator's home directory by resolving them through the `MsgStoreCode` on-chain transaction. The fix introduces a `path-guard` module that enforces a root directory, rejects symlinks, caps file size at 8 MiB, and verifies Wasm magic bytes.
Affected products
- JunoClaw cosmos-mcp < 0.3.0
Timeline
- 2026-04-26: patched: Fixed in version 0.x.y-security-1 (npm @junoclaw/cosmos-mcp@0.3.0)
- 2026-05-12: disclosed: CVE-2026-43989 published