Executive brief
NanoClaw, an AI agent platform, contains a security flaw in how it handles files moving between its internal containers and the host computer. A compromised or malicious AI agent can trick the host system into reading sensitive files or deleting important data outside of its designated workspace. This could lead to the theft of private information or the disruption of the host system's operations.
Technical details
A path traversal and symlink following vulnerability exists in NanoClaw's session manager, specifically within the readOutboxFiles() and clearOutbox() functions. The host process trusts container-supplied strings (messages_out.id and content.files) as path components when processing outbound attachments and performing post-delivery cleanup. Because the agent container has write access to its session directory, an attacker can provide crafted path segments or create symlinks to escape the intended outbox directory. This enables arbitrary file reads on the host with the privileges of the NanoClaw process and, in some scenarios, recursive deletion of host-side paths. The vulnerability was addressed by implementing basename-only validation, rejecting symlinks via lstat(), and performing realpath checks to ensure all operations remain confined to the canonical outbox directory.
Affected products
- Nanoco AI (qwibitai) NanoClaw up to and including 1.2.0
Timeline
- 2026-04-25: disclosed: Initial pull request for the fix submitted.
- 2026-04-30: patched: Fix merged into main branch.
- 2026-05-06: advisory: CVE-2026-7875 published.