JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation_CVE-2026-43989

8.5 / 10

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Description

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Basic Information

ID CVE-2026-43989

Source GitHub_M

Published May 12, 2026 at 16:21

Affected Product

Vendor Dragonmonk111

Product junoclaw

Version < v0.x.y-security-1

Affected Versions Dragonmonk111 junoclaw < v0.x.y-security-1

CWE Classification

CWE-20 CWE-22 CWE-59 CWE-73

References

{
    "lastseen": "",
    "description": "JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.",
    "published": "2026-05-12T16:21:29.084Z",
    "modified": "2026-05-12T16:21:29.084Z",
    "type": "cve",
    "title": "JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation",
    "source": "GitHub_M",
    "references": "https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-rw59-34hw-pmwp\nhttps://github.com/Dragonmonk111/junoclaw/commit/a7886cd\nhttps://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1",
    "id": "CVE-2026-43989",
    "bulletinFamily": "",
    "cwe": [
        "CWE-20",
        "CWE-22",
        "CWE-59",
        "CWE-73"
    ],
    "cvelist": null,
    "sourceData": "Dragonmonk111 junoclaw < v0.x.y-security-1",
    "sourceHref": "",
    "cvss": {
        "score": 8.5,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "junoclaw",
    "version": "< v0.x.y-security-1",
    "vendor": "Dragonmonk111",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}