CVE-2026-10219 is an OS command injection vulnerability affecting nextlevelbuilder GoClaw up to version 3.11.3. The issue is located in the FsBridge.WriteFile function within internal/sandbox/fsbridge.go, part of the write_file tool component. Remote attackers can exploit this vulnerability by manipulating input to execute arbitrary operating system commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although a fix has been proposed via a pull request, it has not yet been merged or officially released. No vendor advisory or patch is currently available.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized control or disruption of the application environment. The medium severity score reflects the potential impact balanced against the complexity and required conditions for exploitation. No known exploits are confirmed in the wild at this time, but a public exploit exists.

No official patch or fix is currently available. A pull request addressing the vulnerability is pending acceptance. Users should monitor the vendor's repository or official channels for updates and apply the fix once it is released. Until then, consider restricting network access to the affected service and applying any available workarounds documented by the vendor if any.