PT-2026-60963 · Nextlevelbuilder · Goclaw

Erichen

·

CVE-2026-16120

·

Published

2026-07-18

·

Updated

2026-07-20

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw versions prior to 3.13.3-beta.4
Description A remote manipulation of the matchesAllowlist() and extractBin() functions within the internal/tools/exec approval.go file can lead to an incorrectly-resolved name.
Recommendations Update nextlevelbuilder GoClaw to version 3.13.3-beta.4 or later. As a temporary workaround, restrict access to the matchesAllowlist() and extractBin() functions to minimize the risk of exploitation.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2026-16120

Affected Products

Goclaw