CVE-2026-19008: Link Following in mf-yang openclaw-cn
A vulnerability exists in mf-yang openclaw-cn up to version 0.2.1 in the assertNoSymlinkEscape function of the apply_patch tool. This flaw allows remote attackers to manipulate link following, potentially leading to unauthorized actions. The vulnerability is identified as CWE-59 (link following). An exploit is publicly available, but no vendor response or patch has been issued yet.
AI Analysis
Technical Summary
The vulnerability in mf-yang openclaw-cn (up to 0.2.1) affects the assertNoSymlinkEscape function in src/agents/sandbox-paths.ts within the apply_patch component. It involves improper handling of symbolic links, allowing an attacker to manipulate link following remotely. This can lead to unintended access or modification of files. The issue was reported early to the project, but no fix or response has been provided. The CVSS 3.1 score is 6.3, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability allows remote attackers with low privileges to manipulate symbolic link following, potentially causing unauthorized disclosure, modification, or disruption of data. The impact affects confidentiality, integrity, and availability, but the overall severity is rated low by the database. No known exploits are reported in the wild beyond the publicly available proof-of-concept.
Mitigation Recommendations
No official patch or fix is currently available, and the vendor has not responded to the issue report. Users should monitor the project for updates or advisories. Until a fix is released, avoid exposing vulnerable versions to untrusted networks or users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-19008: Link Following in mf-yang openclaw-cn
Description
A vulnerability exists in mf-yang openclaw-cn up to version 0.2.1 in the assertNoSymlinkEscape function of the apply_patch tool. This flaw allows remote attackers to manipulate link following, potentially leading to unauthorized actions. The vulnerability is identified as CWE-59 (link following). An exploit is publicly available, but no vendor response or patch has been issued yet.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/mf-yang/openclaw-cnRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in mf-yang openclaw-cn (up to 0.2.1) affects the assertNoSymlinkEscape function in src/agents/sandbox-paths.ts within the apply_patch component. It involves improper handling of symbolic links, allowing an attacker to manipulate link following remotely. This can lead to unintended access or modification of files. The issue was reported early to the project, but no fix or response has been provided. The CVSS 3.1 score is 6.3, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality, integrity, and availability.
Potential Impact
The vulnerability allows remote attackers with low privileges to manipulate symbolic link following, potentially causing unauthorized disclosure, modification, or disruption of data. The impact affects confidentiality, integrity, and availability, but the overall severity is rated low by the database. No known exploits are reported in the wild beyond the publicly available proof-of-concept.
Mitigation Recommendations
No official patch or fix is currently available, and the vendor has not responded to the issue report. Users should monitor the project for updates or advisories. Until a fix is released, avoid exposing vulnerable versions to untrusted networks or users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2mj8-f2gc-5q5j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19008"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a74cfa3bf8831d5391b0f77
Added to database: 08/06/2026, 18:17:07 UTC
Last enriched: 08/06/2026, 19:15:26 UTC
Last updated: 08/07/2026, 03:40:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.