This vulnerability in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 involves the matchesAllowlist/extractBin function within internal/tools/exec_approval.go. A remote attacker can manipulate inputs to cause an incorrectly-resolved name, potentially impacting the application's behavior. The issue has been publicly disclosed, but no vendor-provided remediation or patch is currently available. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows remote attackers to cause incorrect name resolution in the affected function, which may lead to unintended behavior or security bypasses within GoClaw. The exact impact beyond incorrect name resolution is not detailed in the available data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. Until a fix is available, cautious use and limiting exposure of affected versions is advisable.