Threat Intelligence Database

A path traversal vulnerability exists in nanocoai NanoClaw up to version 2.0.64, specifically in the send_file component within the file container/agent-runner/src/mcp-tools/core.ts. This vulnerability can be exploited remotely without authentication. The issue has been publicly disclosed, but the project has not yet responded or issued a fix.

A vulnerability in nanocoai NanoClaw up to version 2.0.64 affects the handleCreateAgent function in the Child-Agent Creation component. This flaw involves improper privilege management that can be exploited remotely. The exploit code is publicly available, but there is no vendor response or patch at this time.

A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core.ts of the component send_file. Such manipulation leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-17434 is a medium severity vulnerability in nanocoai NanoClaw up to version 2.0.64. It involves improper authorization in the handleAddMcpServer function within the add_mcp_server component. The flaw can be exploited remotely to bypass authorization controls. An exploit has been published. A patch identified by commit e5b928783d5c485637565eb07d2967922dfbf8d8 is available to remediate the issue.

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.