CVE-2026-16130

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16130

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16130.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16130

Published

2026-07-18T17:15:10.968Z

Modified

2026-07-22T05:29:59.984507318Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

nearai ironclaw write_file path_utils.rs validate_path link following

Details

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validatepath of the file src/tools/builtin/pathutils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16130.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-59"
    ]
}

References

Affected packages

Git / github.com/nearai/ironclaw

Affected ranges

Type

GIT

Repo

https://github.com/nearai/ironclaw

Events

Introduced

f0abd23b9ecfff5c9ce7b0177002c602e8d3344f

Fixed

369ff3d240cf3c0787b50e1e9f182e1a06c71255

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0.29.0"
        },
        {
            "last_affected": "0.29.0"
        },
        {
            "introduced": "0.29.1"
        },
        {
            "last_affected": "0.29.1"
        }
    ]
}

Affected versions

0.*

0.29.0

0.29.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16130.json"