CVE-2026-43989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-43989
Aliases
  • GHSA-rw59-34hw-pmwp
Published
2026-05-12T16:21:29Z
Modified
2026-08-12T03:51:24Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation
Details

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-22",
        "CWE-59",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43989.json"
}
References

Affected packages

Git / github.com/dragonmonk111/junoclaw

Affected ranges

Type
GIT
Repo
https://github.com/dragonmonk111/junoclaw
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7886cd
Fixed
6b56230bd3cdf3cad2fdc6a3e2172131d59d1551
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "v0.x.y-security-1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43989.json"