The vulnerability in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 involves improper handling of the args.targetUrl parameter in the handleNavigate function of pkg/browser/tool.go. This flaw allows an attacker to remotely manipulate this argument to cause information disclosure. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality. No official fix or patch has been documented, and the product is not a cloud service, so remediation depends on vendor updates. Exploit code is publicly available, increasing the risk of exploitation despite no current reports of active attacks.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information from the affected system. The attacker can perform the attack remotely without requiring privileges or user interaction. The confidentiality impact is low, meaning some information may be exposed but not critical system control or integrity. There is no impact on availability or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, consider restricting access to the affected functionality or input validation on args.targetUrl if possible to reduce exposure.