CVE-2026-90807

nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

State: Published
Severity: 5.3 Medium
Published: Sep 14, 2026
Updated: Sep 16, 2026
Reserved: Sep 13, 2026

Description

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-59 Link Following

Affected Products

Product	Versions
NanoClawnanocoai	2.1.0Affected 2.1.1Affected 2.1.2Affected 2.1.3Affected 2.1.4Affected 2.1.5Affected 2.1.6Affected 2.1.7Affected 2.1.8Affected 2.1.9Affected 2.1.10Affected 2.1.11Affected 2.1.12Affected 2.1.13Affected 2.1.14Affected 2.1.15Affected 2.1.16Affected 2.1.17Affected

References

VDB-403309 | nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link followingvdb-entrytechnical-description
VDB-403309 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-90807 | CVE Analysis and Reportthird-party-advisory
Submit #922841 | nanocoai nanoclaw <= 2.1.17 Improper Link Resolution Before File Access / Link Following (CWE-59)third-party-advisory
https://github.com/nanocoai/nanoclaw/issues/2828exploitissue-tracking
https://github.com/nanocoai/nanoclaw/commit/3f9ed607b7e7a4872747295f75286f1c377d7c33patch
https://github.com/nanocoai/nanoclaw/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.