CVE-2026-16130

Name of the Vulnerable Software and Affected Versions nearai ironclaw versions prior to 0.29.2

Description A flaw exists in the write file component within the validate path() function located in the src/tools/builtin/path utils.rs file. This issue allows for link following, which occurs when a program follows a symbolic link to a location outside the intended directory. Local access is required to execute this attack.

Recommendations Apply patch 369ff3d240cf3c0787b50e1e9f182e1a06c71255 to resolve the issue. As a temporary mitigation, restrict access to the validate path() function.