A vulnerability was identified in nearai ironclaw up to 0.29.1. (CVE-2026-16130)
A vulnerability exists in nearai ironclaw versions up to 0.29.1 in the validate_path function of src/tools/builtin/path_utils.rs within the write_file component. This vulnerability allows link following due to improper path validation. Exploitation requires local access. A patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 is recommended to fix the issue. The vulnerability is classified as CWE-59 (Link Following).
AI Analysis
Technical Summary
The nearai ironclaw software up to version 0.29.1 contains a vulnerability in the validate_path function of the write_file component. This flaw allows an attacker with local access to manipulate path validation, leading to unintended link following. The vulnerability is publicly known and an exploit exists, though no known exploits are reported in the wild. A patch has been created to address this issue, identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255.
Potential Impact
The vulnerability enables local attackers to cause the software to follow symbolic links improperly, which may lead to unauthorized file access or modification. The impact is limited by the requirement for local access and the low severity rating. No remote exploitation or privilege escalation is indicated.
Mitigation Recommendations
Apply the patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 to fix the vulnerability in the validate_path function. Since the vulnerability requires local access, restricting local user permissions may also reduce risk. Patch status is confirmed by the presence of the patch commit; no vendor advisory contradicts this.
A vulnerability was identified in nearai ironclaw up to 0.29.1. (CVE-2026-16130)
Description
A vulnerability exists in nearai ironclaw versions up to 0.29.1 in the validate_path function of src/tools/builtin/path_utils.rs within the write_file component. This vulnerability allows link following due to improper path validation. Exploitation requires local access. A patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 is recommended to fix the issue. The vulnerability is classified as CWE-59 (Link Following).
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nearai ironclaw software up to version 0.29.1 contains a vulnerability in the validate_path function of the write_file component. This flaw allows an attacker with local access to manipulate path validation, leading to unintended link following. The vulnerability is publicly known and an exploit exists, though no known exploits are reported in the wild. A patch has been created to address this issue, identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255.
Potential Impact
The vulnerability enables local attackers to cause the software to follow symbolic links improperly, which may lead to unauthorized file access or modification. The impact is limited by the requirement for local access and the low severity rating. No remote exploitation or privilege escalation is indicated.
Mitigation Recommendations
Apply the patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 to fix the vulnerability in the validate_path function. Since the vulnerability requires local access, restricting local user permissions may also reduce risk. Patch status is confirmed by the presence of the patch commit; no vendor advisory contradicts this.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g37g-6895-qw74
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16130"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a5bd3172a4a8d5989284c8e
Added to database: 07/18/2026, 19:25:11 UTC
Last enriched: 07/18/2026, 19:25:27 UTC
Last updated: 07/19/2026, 06:26:34 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.