Executive brief
NanoClaw is a containerized agent platform that connects to messaging services like WhatsApp and Slack. A flaw in the attachment handler allows remote attackers to manipulate file paths and follow symlinks, potentially exposing or overwriting arbitrary files on the system without requiring authentication.
Technical details
A link-following vulnerability exists in the forwardAttachedFiles function of src/modules/agent-to-agent/agent-route.ts in the Attachment Handler component. The vulnerability allows an attacker to manipulate file path inputs to cause the application to follow symbolic links or traverse directories, leading to unauthorized file access or modification. The attack is remotely exploitable and requires no authentication. A patch is available as commit 3f9ed607b7e7a4872747295f75286f1c377d7c33.
Affected products
- nanocoai NanoClaw up to 2.1.17
Timeline
- 2026-09-14: disclosed