The vulnerability CVE-2026-16120 affects nextlevelbuilder GoClaw versions up to 3.13.3-beta.3. It involves the matchesAllowlist/extractBin function in the internal/tools/exec_approval.go file, where an attacker can remotely manipulate inputs to cause an incorrectly-resolved name. This flaw could potentially be exploited to affect the program's behavior related to name resolution. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability has been publicly disclosed, but no vendor advisory or patch information is currently available.

An attacker can remotely exploit this vulnerability to cause the application to incorrectly resolve names, which may lead to unexpected behavior or security bypasses in the affected function. The impact is rated medium based on CVSS 4.0 with partial confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.