This vulnerability exists in the GoClaw product by nextlevelbuilder, specifically in the FsBridge.WriteFile function of the internal/sandbox/fsbridge.go component. It allows remote attackers to perform OS command injection via manipulation of the write_file tool. The issue affects versions 3.11.0 through 3.11.3. Although an exploit is publicly known, the fix is not yet officially released and is awaiting pull request acceptance. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation could allow remote attackers to execute arbitrary operating system commands on the affected system, potentially leading to unauthorized system control or data compromise. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, no required privileges or user interaction, and low to limited scope and impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available as the fix is pending acceptance of a pull request. Users should monitor the vendor's repository or official channels for the acceptance and release of the fix. Until then, consider restricting access to the vulnerable functionality or applying any available temporary workarounds if provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.