CVE-2026-10219

Vulnerability

A vulnerability exists in nextlevelbuilder GoClaw up to version 3.11.3, specifically in the FsBridge.WriteFile function within internal/sandbox/fsbridge.go. The write_file tool, invoked by the LLM, constructs a shell command using sh -c with Go's %q format verb to embed a user-controlled file path. Go's %q does not escape Bash metacharacters such as $(), backticks, or semicolons, allowing command injection when the path is interpreted by the shell [1][2][3]. The bug is tracked as issue #1121 and is classified as CWE-78 with a CVSS 9.8 (Critical) [2][3].

Exploitation

An attacker must be able to influence the file path argument to the write_file tool, which can be achieved remotely by crafting a malicious prompt that causes the LLM to output a path containing shell metacharacters (e.g., notes/$(touch /tmp/pwned).txt). No authentication is required if the sandbox mode is enabled (GOCLAW_SANDBOX_MODE=all) and the instance accepts unauthenticated client requests [2][3]. The attacker does not need prior access; any user of the AI agent platform can submit such prompts [3]. The resulting command executed inside the sandbox container, as root, is, for example: sh -c 'cat > "/workspace/notes/$(touch /tmp/pwned).txt"' — the shell evaluates the command substitution before the file write occurs [2].

Impact

Successful exploitation allows arbitrary OS command execution as the root user inside the sandbox container. This leads to full compromise of confidentiality, integrity, and availability of the sandbox and potentially the host, depending on container isolation. The attacker can read, modify, or delete any data accessible to the container, and potentially escape to the host if additional misconfigurations exist [1][2][3].

Mitigation

A fix has been proposed in pull request #1155, which removes the sh -c invocation entirely and writes files using tee with the filename passed as a discrete argv entry, eliminating shell interpretation [2]. As of the publication date (2026-06-01), the pull request awaits acceptance and has not yet been merged into a release [1][2]. No official patched version is available; users are advised to disable sandbox mode (GOCLAW_SANDBOX_MODE=none) or restrict access to the platform until a fix is released [2][3].