CVE-2026-19008

EUVD-2026-53766

06.08.2026, 08:16

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Link Following

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 26.86%

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References

https://github.com/mf-yang/openclaw-cn/

https://github.com/mf-yang/openclaw-cn/issues/565

https://github.com/mf-yang/openclaw-cn/issues/566

https://vuldb.com/cve/CVE-2026-19008

https://vuldb.com/submit/862644

https://vuldb.com/submit/862645

https://vuldb.com/vuln/386391

https://vuldb.com/vuln/386391/cti