Description
A vulnerability was found in nextlevelbuilder GoClaw up to 3.11.3. This impacts the function FsBridge.WriteFile of the file internal/sandbox/fsbridge.go of the component write_file Tool. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nextlevelbuilder | GoClaw | 3.11.0, 3.11.1, 3.11.2, 3.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/nextlevelbuilder/goclaw | <= 3.11.3 | — | GHSA-6jm8-4fhr-5w64 |
| Go | github.com/nextlevelbuilder/goclaw | all versions | — | GO-2026-5951 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
References
- VDB-367498 | nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection vdb-entry technical-description
- VDB-367498 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-10219 | CVE Analysis and Report third-party-advisory
- Submit #821939 | nextlevelbuilder goclaw <= v3.11.3 OS Command Injection (CWE-78) third-party-advisory
- https://github.com/nextlevelbuilder/goclaw/issues/1121 exploit issue-tracking
- https://github.com/nextlevelbuilder/goclaw/pull/1155 issue-tracking patch
- https://github.com/nextlevelbuilder/goclaw/ product