CVE-2026-43989

8.5 Élevée

Publiée le 12/05/2026 à 19:16 · Modifiée le 17/06/2026 à 12:50 · Analyse NVD reportée · Source : security-advisories@github.com

Description

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Traduire en français

Produits concernés

Dragonmonk111 junoclaw

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`

Faiblesses (CWE)

CWE-20
CWE-22
CWE-59
CWE-73

Références

https://github.com/Dragonmonk111/junoclaw/commit/a7886cd
https://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1
https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-rw59-34hw-pmwp

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories