CVE-2026-43989

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-43989

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43989.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-43989

Aliases

GHSA-rw59-34hw-pmwp

Published

2026-05-12T16:21:29.084Z

Modified

2026-08-04T11:50:58.629292965Z

Severity

8.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L CVSS Calculator

Summary

JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation

Details

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-22",
        "CWE-59",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43989.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/dragonmonk111/junoclaw

Affected ranges

Type

GIT

Repo

https://github.com/dragonmonk111/junoclaw

Events

Introduced

Fixed

6b56230bd3cdf3cad2fdc6a3e2172131d59d1551

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v0.x.y-security-1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43989.json"