CVE-2026-18038

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-18038

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18038.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-18038

Published

2026-07-28T12:45:11.475Z

Modified

2026-07-30T04:00:53.701067656Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

Details

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1230. It is advisable to implement a patch to correct this issue.

Database specific

{
    "cwe_ids": [
        "CWE-200",
        "CWE-284"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18038.json",
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/nextlevelbuilder/goclaw

Affected ranges

Type

GIT

Repo

https://github.com/nextlevelbuilder/goclaw

Events

Introduced

20f7dac7a9ee2eb54b7d56a1021183e29262dd9e

Last affected

d85bf17171fd0faefbbd54df44bef573991aa7f8

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.13.0"
        },
        {
            "last_affected": "3.13.0"
        },
        {
            "introduced": "3.13.1"
        },
        {
            "last_affected": "3.13.1"
        },
        {
            "introduced": "3.13.2"
        },
        {
            "last_affected": "3.13.2"
        }
    ]
}

Affected versions

3.*

3.13.0

3.13.1

3.13.2

v3.*

v3.13.0

v3.13.1

v3.13.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18038.json"