The vulnerability CVE-2026-43989 affects the Dragonmonk111 junoclaw product, specifically the upload_wasm MCP tool before version 0.x.y-security-1. The tool improperly validates input by accepting a filesystem path from the agent and uploading the bytes located at that path without checking for path traversal, symlink targets, file size limits, or file format validation. This can allow an attacker to cause unauthorized file uploads or potentially overwrite critical files, leading to a complete compromise of confidentiality and integrity, and partial impact on availability. The vulnerability is categorized under CWE-20 (Improper Input Validation), CWE-22 (Path Traversal), CWE-59 (Link Following), and CWE-73 (External Control of File Name or Path). The CVSS 3.1 base score is 8.5, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity with low impact on availability. The vulnerability is fixed in version 0.x.y-security-1, but no explicit vendor advisory or patch link is provided in the data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure or modification of sensitive data due to improper validation of file paths and contents uploaded by the agent. The attacker can potentially upload arbitrary files or overwrite important files, impacting confidentiality and integrity severely, with some impact on availability. The CVSS score of 8.5 reflects these high impacts. No known exploits in the wild have been reported.

The vulnerability is fixed in version 0.x.y-security-1 of the junoclaw product. Users should upgrade to this version or later to remediate the issue. Since no explicit vendor advisory or patch link is provided, users should consult the vendor Dragonmonk111 for official patch availability and guidance. Until patched, restrict access to the upload_wasm MCP tool and validate inputs externally if possible. Patch status is not yet confirmed in the advisory; verify with the vendor for current remediation guidance.