CVE-2026-19008

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19008

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19008.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19008

Published

2026-08-06T06:30:09.917Z

Modified

2026-08-08T03:32:25.479963640Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

Details

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19008.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-59"
    ]
}

References

Affected packages

Git / github.com/mf-yang/openclaw-cn

Affected ranges

Type

GIT

Repo

https://github.com/mf-yang/openclaw-cn

Events

Introduced

1b9f16468d9841871cb15103693c3923424c9842

Last affected

558f272e6c90e7e0c37644e505e161b91ef738f0

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        },
        {
            "introduced": "0.2.1"
        },
        {
            "last_affected": "0.2.1"
        }
    ]
}

Affected versions

0.*

0.2.0

0.2.1

v0.*

v0.2.0

v0.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19008.json"