The vulnerability in nextlevelbuilder GoClaw 3.11.3 resides in the ExecApprovalManager.CheckCommand function within internal/tools/exec_approval.go. Due to incomplete blacklist enforcement, remote attackers can manipulate commands to bypass security controls. The issue has been publicly disclosed with exploit code available. No official fix or patch has been documented as of the publication date.

An attacker with network access and limited privileges can remotely exploit the incomplete blacklist to execute unauthorized commands or actions that should be blocked. This could lead to partial compromise of system integrity or unauthorized operations within the affected application context. The CVSS 4.0 base score is 5.3, indicating a medium impact with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing additional access controls or monitoring around command execution functions to mitigate potential exploitation.