CVE-2026-43989 | THREATINT

Description

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

PUBLISHED Reserved 2026-05-04 | Published 2026-05-12 | Updated 2026-05-14 | Assigner GitHub_M

HIGH: 8.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Problem types

CWE-20: Improper Input Validation

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CWE-73: External Control of File Name or Path

Product status

< v0.x.y-security-1

affected

References

github.com/...noclaw/security/advisories/GHSA-rw59-34hw-pmwp

github.com/Dragonmonk111/junoclaw/commit/a7886cd

github.com/...onk111/junoclaw/releases/tag/v0.x.y-security-1

cve.org (CVE-2026-43989)

nvd.nist.gov (CVE-2026-43989)

Download JSON