CVE-2026-16120
A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.40%
- CWE
- CWE-706
- Published
- 2026-07-18
- Last modified
- 2026-07-20
Affected products
- nextlevelbuilder GoClaw
- nextlevelbuilder GoClaw
- nextlevelbuilder GoClaw
- nextlevelbuilder GoClaw
Weakness type
Related vulnerabilities
- CVE-2026-87618 — Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36...
- CVE-2026-87562 — Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-87613 — Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-87547 — Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-81383 — Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-79254 — Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79273 — Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65...
- CVE-2026-79103 — Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote...