CVE-2026-15621
Full vulnerability record from the local CVENow database.
Description
A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was closed with the label "not planned".
Severity
MEDIUM
CVSS score
4.8
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-14 01:16:17.033000
Last modified
2026-10-24 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2026-15621",
"sourceIdentifier": "[email protected]",
"published": "2026-07-14T01:16:17.033",
"lastModified": "2026-10-24T22:10:00.210",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was closed with the label \"not planned\"."
},
{
"lang": "es",
"value": "Una vulnerabilidad fue detectada en mosaxiv clawlet hasta 0.2.10. Esto afecta a la función read_file/write_file/edit_file del archivo tools/fs_ops.go del componente File Tools. Realizar una manipulación resulta en seguimiento de enlaces. El ataque necesita ser abordado localmente. El problema de GitHub reportado fue cerrado con la etiqueta ’not planned’."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "mosaxiv",
"product": "clawlet",
"cpes": [
"cpe:2.3:a:mosaxiv:clawlet:*:*:*:*:*:*:*:*"
],
"modules": [
"File Tools"
],
"versions": [
{
"version": "0.2.0",
"status": "affected"
},
{
"version": "0.2.1",
"status": "affected"
},
{
"version": "0.2.2",
"status": "affected"
},
{
"version": "0.2.3",
"status": "affected"
},
{
"version": "0.2.4",
"status": "affected"
},
{
"version": "0.2.5",
"status": "affected"
},
{
"version": "0.2.6",
"status": "affected"
},
{
"version": "0.2.7",
"status": "affected"
},
{
"version": "0.2.8",
"status": "affected"
},
{
"version": "0.2.9",
"status": "affected"
},
{
"version": "0.2.10",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 4.3,
"accessVector": "LOCAL",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.1,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-14T12:40:34.700214Z",
"id": "CVE-2026-15621",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
],
"references": [
{
"url": "https://github.com/mosaxiv/clawlet/",
"source": "[email protected]"
},
{
"url": "https://github.com/mosaxiv/clawlet/issues/15",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-15621",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/855796",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/378124",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/378124/cti",
"source": "[email protected]"
},
{
"url": "https://github.com/mosaxiv/clawlet/issues/15",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
]
}