Medium 6.3Published Sep 14, 2026

CVE-2026-90807nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects nanocoai NanoClaw. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for nanocoai NanoClaw

Exploited in the last 30 days

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

CVSS: 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-59
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Sep 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

nanocoai NanoClaw nanocoai:nanoclaw	2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; 2.1.6; 2.1.7; and 10 more ranges	CNA record

References

https://vuldb.com/vuln/403309vdb-entry, technical-description
https://vuldb.com/vuln/403309/ctisignature, permissions-required
https://vuldb.com/cve/CVE-2026-90807third-party-advisory
https://vuldb.com/submit/922841third-party-advisory
https://github.com/nanocoai/nanoclaw/issues/2828exploit, issue-tracking
https://github.com/nanocoai/nanoclaw/commit/3f9ed607b7e7a4872747295f75286f1c377d7c33patch
https://github.com/nanocoai/nanoclaw/product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.