CVE-2026-15620

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15620

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15620.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15620

Published

2026-07-14T00:15:08.152Z

Modified

2026-07-16T03:48:17.318161418Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery

Details

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/toolwebfetch.go. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed with the label "not planned".

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15620.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.2.0"
                },
                {
                    "last_affected": "0.2.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/mosaxiv/clawlet

Affected ranges

Type

GIT

Repo

https://github.com/mosaxiv/clawlet

Events

Introduced

bc0e279682b009533be7c9ec6b5dda796fc20ffb

Last affected

c6ea754c8932c16591a973d30a97abb26b9a12a6

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        },
        {
            "introduced": "0.2.2"
        },
        {
            "last_affected": "0.2.2"
        },
        {
            "introduced": "0.2.3"
        },
        {
            "last_affected": "0.2.3"
        },
        {
            "introduced": "0.2.4"
        },
        {
            "last_affected": "0.2.4"
        },
        {
            "introduced": "0.2.5"
        },
        {
            "last_affected": "0.2.5"
        },
        {
            "introduced": "0.2.6"
        },
        {
            "last_affected": "0.2.6"
        },
        {
            "introduced": "0.2.7"
        },
        {
            "last_affected": "0.2.7"
        },
        {
            "introduced": "0.2.8"
        },
        {
            "last_affected": "0.2.8"
        },
        {
            "introduced": "0.2.9"
        },
        {
            "last_affected": "0.2.9"
        },
        {
            "introduced": "0.2.10"
        },
        {
            "last_affected": "0.2.10"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.2.1

0.2.10

0.2.2

0.2.3

0.2.4

0.2.5

0.2.6

0.2.7

0.2.8

0.2.9

v0.*

v0.2.1

v0.2.10

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15620.json"