CVE Feed

    Dashboard / CVE / CVE-2026-90807

    CVE-2026-90807

    A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The exploit has been made public and could be used. The patch is identified as 3f9ed607b7e7a4872747295f75286f1c377d7c33. It is advisable to implement a patch to correct this issue.

    Published:Sep 14, 2026
    Last Modified:Sep 16, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00288
    CVSS Score:6.3

    Affected Products

    Vendor
    Nanocoai
    Product
    Nanoclaw

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High