Symlink Following Vulnerability in NanoClaw by NanoCo

CVE-2026-56692

What is CVE-2026-56692?

NanoClaw versions prior to 2.1.17 exhibit a symlink following vulnerability in the forwardAttachedFiles functionality. This flaw permits container-controlled agents to exfiltrate files that are readable by the host. The vulnerability arises because the attachment filename validation is inadequately handled; it relies solely on the isSafeAttachmentName function prior to using fs.copyFileSync. This method mistakenly follows symlinks without sufficient containment checks, risking the disclosure of arbitrary files from the host system.

References