NanoClaw Arbitrary Local File Read via send_file Path Traversal (CVE-2026-29611)

Vulnerability Overview Title: [Security] Arbitrary local file exfiltration via send_file absolute path handling #2760 Description: The built-in MCP tool in NanoClaw accepts absolute filesystem paths and copies referenced files to the outbound inbox without verifying whether the target is trusted. Prompt injection or compromised agents can exploit this behavior to exfiltrate any locally visible files within the container, including those mounted under , through NanoClaw's normal attachment delivery path. Details: The vulnerability logic resides in the tool handler located in . The handler explicitly logs that the can be relative to or absolute. When an absolute path is provided, the code accepts it unchanged, checks only for the file's existence, and then copies it to . There is no whitelist allowing access to local root directories, no normalization, and no container check enforcing read operations to remain within or other explicitly trusted directories. Consequently, once an agent can invoke , it can copy any file visible within the container namespace for downstream delivery. This is particularly relevant because the agent runner automatically discovers other mounted directories under and exposes them to the agent runtime. In real-world scenarios, these mounts can contain reports, shared project files, or other sensitive local data that should not be delivered as standard agent-generated attachments. Impact Scope Affected Products: - Ecosystem: npm - Package Name: nanoclaw - Affected Versions: < 2.0.64 Severity: High Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Remediation Fixed Version: 2.0.64 and later POC Code Additional Information PoC Prerequisites: - Deployment using a vulnerable version of NanoClaw, up to v2.0.64 - Local installation of Node and Python 3 - Ability to run the built-in agent runner MCP server - Writable local directory - Readable files outside of , such as files under Reproduction Steps: 1. Download the verification test from 2. Download the MCP driver from 3. Download the control script from 4. Run the verification test from the repository root 5. The verification test will: - Create - Create - Start the actual built-in MCP stdio server - Call once with - Call once with 6. Inspect and confirm that the vulnerable call copies to Evidence Logs: - The verification test produced the following runtime evidence: - Verification Mode: Integration-Test - Interface: Actual nanoclaw built-in MCP stdio server ( ) - Control Run Results: - : - : - Vulnerable Prerequisite Run Results: - : - : - Separate Control Log Confirmation: - A benign relative path only copies the expected workspace file: - : - : - : - : true - : false Impact: - This is an arbitrary local file read vulnerability that directly leads to data exfiltration via NanoClaw's outbound attachment pipeline. Any deployment exposing agents to sensitive mounted directories is affected. Prompt injection or compromised agents can repurpose the normal file-sending functionality to export local documents, internal artifacts, or other readable files to external messaging destinations. Weakness: - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Occurrence: - Link: - Line Numbers: 136 to 147 - Code Snippet: Other Links: - - Line Numbers: 56 to 67 - Code Snippet: Mentions: - mentioned this on 2026-06-15 - mentioned this on 2026-06-15 - mentioned this on 2026-06-18 New Issue: - Create New Issue Participants: - Open in GitHub Copilot App Notifications: - Notifications - Forks: 12.9k - Stars: 30.5k Other: - Code - Issues: 306 - Pull requests: 564 - Discussions - Actions - Projects - Security & quality - Insights Footer: - © 2026 GitHub, Inc. - Terms - Privacy - Security - Status - Community - Docs - Contact - Manage cookies - Do not share my personal information Sign up: - Sign up for free - Join this GitHub discussion. Already have an account? Log in to comment Other: - Platform - Solutions - Resources - Open source - Enterprise - Pricing - Search - Log in - Sign up Other: - nanoclaw / nanoclaw Public - Notifications - Forks: 12.9k - Stars: 30.5k Other: - Code - Issues: 306 - Pull requests: 564 - Discussions - Actions - Projects - Security and quality - Insights Other: - [Security] Arbitrary local file exfiltration via send_file absolute path handling #2760 - New Issue - Open Other: - YLChen-007 posted on June 14 - Suggestion details - Title: Arbitrary local file exfiltration via send_file absolute path handling - Description: - Summary: - Details: - PoC - Prerequisites: - Reproduction steps: - Evidence logs: - Impact: - Affected products: - Severity: - Weakness: - Occurrence: - Link: - Other links: - Mentions: - New Issue: - Participants: - Notifications: - Other: - Footer: - Register: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Other: - Othe

Goal Reached Thanks to every supporter — we hit 100%!

NanoClaw Arbitrary Local File Read via send_file Path Traversal (CVE-2026-29611)

More from this source