CVE-2026-18991
Full vulnerability record from the local CVENow database.
Description
A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component send_file. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
MEDIUM
CVSS score
5.5
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-06 03:16:22.130000
Last modified
2026-10-23 21:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-18991",
"sourceIdentifier": "[email protected]",
"published": "2026-08-06T03:16:22.130",
"lastModified": "2026-10-23T21:10:00.157",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component send_file. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Una vulnerabilidad de seguridad ha sido detectada en nanocoai NanoClaw hasta 2.0.64. Esto afecta una parte desconocida del archivo container/agent-runner/src/mcp-tools/core.ts del componente send_file. Dicha manipulación conduce a salto de ruta. El ataque puede ser ejecutado remotamente. El exploit ha sido divulgado públicamente y puede ser usado. El proyecto fue informado del problema temprano a través de un informe de incidencias pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "nanocoai",
"product": "NanoClaw",
"cpes": [
"cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"send_file"
],
"versions": [
{
"version": "2.0.0",
"status": "affected"
},
{
"version": "2.0.1",
"status": "affected"
},
{
"version": "2.0.2",
"status": "affected"
},
{
"version": "2.0.3",
"status": "affected"
},
{
"version": "2.0.4",
"status": "affected"
},
{
"version": "2.0.5",
"status": "affected"
},
{
"version": "2.0.6",
"status": "affected"
},
{
"version": "2.0.7",
"status": "affected"
},
{
"version": "2.0.8",
"status": "affected"
},
{
"version": "2.0.9",
"status": "affected"
},
{
"version": "2.0.10",
"status": "affected"
},
{
"version": "2.0.11",
"status": "affected"
},
{
"version": "2.0.12",
"status": "affected"
},
{
"version": "2.0.13",
"status": "affected"
},
{
"version": "2.0.14",
"status": "affected"
},
{
"version": "2.0.15",
"status": "affected"
},
{
"version": "2.0.16",
"status": "affected"
},
{
"version": "2.0.17",
"status": "affected"
},
{
"version": "2.0.18",
"status": "affected"
},
{
"version": "2.0.19",
"status": "affected"
},
{
"version": "2.0.20",
"status": "affected"
},
{
"version": "2.0.21",
"status": "affected"
},
{
"version": "2.0.22",
"status": "affected"
},
{
"version": "2.0.23",
"status": "affected"
},
{
"version": "2.0.24",
"status": "affected"
},
{
"version": "2.0.25",
"status": "affected"
},
{
"version": "2.0.26",
"status": "affected"
},
{
"version": "2.0.27",
"status": "affected"
},
{
"version": "2.0.28",
"status": "affected"
},
{
"version": "2.0.29",
"status": "affected"
},
{
"version": "2.0.30",
"status": "affected"
},
{
"version": "2.0.31",
"status": "affected"
},
{
"version": "2.0.32",
"status": "affected"
},
{
"version": "2.0.33",
"status": "affected"
},
{
"version": "2.0.34",
"status": "affected"
},
{
"version": "2.0.35",
"status": "affected"
},
{
"version": "2.0.36",
"status": "affected"
},
{
"version": "2.0.37",
"status": "affected"
},
{
"version": "2.0.38",
"status": "affected"
},
{
"version": "2.0.39",
"status": "affected"
},
{
"version": "2.0.40",
"status": "affected"
},
{
"version": "2.0.41",
"status": "affected"
},
{
"version": "2.0.42",
"status": "affected"
},
{
"version": "2.0.43",
"status": "affected"
},
{
"version": "2.0.44",
"status": "affected"
},
{
"version": "2.0.45",
"status": "affected"
},
{
"version": "2.0.46",
"status": "affected"
},
{
"version": "2.0.47",
"status": "affected"
},
{
"version": "2.0.48",
"status": "affected"
},
{
"version": "2.0.49",
"status": "affected"
},
{
"version": "2.0.50",
"status": "affected"
},
{
"version": "2.0.51",
"status": "affected"
},
{
"version": "2.0.52",
"status": "affected"
},
{
"version": "2.0.53",
"status": "affected"
},
{
"version": "2.0.54",
"status": "affected"
},
{
"version": "2.0.55",
"status": "affected"
},
{
"version": "2.0.56",
"status": "affected"
},
{
"version": "2.0.57",
"status": "affected"
},
{
"version": "2.0.58",
"status": "affected"
},
{
"version": "2.0.59",
"status": "affected"
},
{
"version": "2.0.60",
"status": "affected"
},
{
"version": "2.0.61",
"status": "affected"
},
{
"version": "2.0.62",
"status": "affected"
},
{
"version": "2.0.63",
"status": "affected"
},
{
"version": "2.0.64",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-06T14:51:37.055065Z",
"id": "CVE-2026-18991",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://github.com/nanocoai/nanoclaw/",
"source": "[email protected]"
},
{
"url": "https://github.com/nanocoai/nanoclaw/issues/2760",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-18991",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/862563",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386367",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/386367/cti",
"source": "[email protected]"
}
]
}