A vulnerability was detected in antoinersx clawhost up to 0.0.45. (CVE-2026-112251)

CVE-2026-112251 describes an open redirect vulnerability in antoinersx clawhost versions up to 0.0.45. The issue resides in the handleRequest function within apps/clawhostgo/src/main/services/reverseProxy.ts, specifically in the Reverse Proxy component. By manipulating the token argument, an attacker can cause the application to redirect users to arbitrary external URLs. This vulnerability is remotely exploitable and public exploit code has been published. The vendor was contacted but did not respond, and no official patch or remediation has been disclosed.

The vulnerability allows an attacker to perform open redirect attacks, which can be used to redirect users to malicious sites potentially facilitating phishing or other social engineering attacks. There is no direct impact on confidentiality or availability reported. The CVSS score is 4.3 (low severity), reflecting limited impact primarily on integrity via user redirection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should exercise caution when handling URLs involving the token parameter in the affected component. Consider implementing input validation or URL filtering as a temporary mitigation until an official fix is released.