CVE-2026-15619

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15619

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15619.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15619

Published

2026-07-14T00:00:12.931Z

Modified

2026-07-16T03:48:17.350263978Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery

Details

A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function webfetch of the file tools/toolweb_fetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed with the label "not planned".

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15619.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.2.0"
                },
                {
                    "last_affected": "0.2.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/mosaxiv/clawlet

Affected ranges

Type

GIT

Repo

https://github.com/mosaxiv/clawlet

Events

Introduced

bc0e279682b009533be7c9ec6b5dda796fc20ffb

Last affected

c6ea754c8932c16591a973d30a97abb26b9a12a6

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        },
        {
            "introduced": "0.2.2"
        },
        {
            "last_affected": "0.2.2"
        },
        {
            "introduced": "0.2.3"
        },
        {
            "last_affected": "0.2.3"
        },
        {
            "introduced": "0.2.4"
        },
        {
            "last_affected": "0.2.4"
        },
        {
            "introduced": "0.2.5"
        },
        {
            "last_affected": "0.2.5"
        },
        {
            "introduced": "0.2.6"
        },
        {
            "last_affected": "0.2.6"
        },
        {
            "introduced": "0.2.7"
        },
        {
            "last_affected": "0.2.7"
        },
        {
            "introduced": "0.2.8"
        },
        {
            "last_affected": "0.2.8"
        },
        {
            "introduced": "0.2.9"
        },
        {
            "last_affected": "0.2.9"
        },
        {
            "introduced": "0.2.10"
        },
        {
            "last_affected": "0.2.10"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.2.1

0.2.10

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

v0.*

v0.2.1

v0.2.10

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15619.json"