CVE-2026-90807

medium

A vulnerability was found in nanocoai NanoClaw up to 2.1.17.

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

CVSS

6.3

6.3 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity source: NVD CVSS v3.1 (cna@vuldb.com)

Timeline (UTC)

Published: 2026-09-14 18:20

Modified: 2026-09-16 17:18

NVD status: Deferred

Last synced 1 day ago

Verified against the source API 2026-10-27 06:53 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-59

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/nanocoai/nanoclaw/ cna@vuldb.com
https://github.com/nanocoai/nanoclaw/commit/3f9ed607b7e7a4872747295f75286f1c377d7c33 cna@vuldb.com
https://github.com/nanocoai/nanoclaw/issues/2828 cna@vuldb.com
https://vuldb.com/cve/CVE-2026-90807 cna@vuldb.com
https://vuldb.com/submit/922841 cna@vuldb.com
https://vuldb.com/vuln/403309 cna@vuldb.com
https://vuldb.com/vuln/403309/cti cna@vuldb.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:53 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores