CVE-2026-90807

Name of the Vulnerable Software and Affected Versions ananocoai NanoClaw versions prior to 2.1.18

Description A remote issue exists in the Attachment Handler component within the forwardAttachedFiles() function located in the src/modules/agent-to-agent/agent-route.ts file. This flaw allows for link following, which occurs when an application follows a symbolic link to a file outside the intended directory.

Recommendations Apply patch 3f9ed607b7e7a4872747295f75286f1c377d7c33 to resolve the issue. As a temporary workaround, restrict the use of the forwardAttachedFiles() function until the patch is applied.