Path Traversal in NearAI Ironclaw

Executive Summary

CVE-2026-16130 is a vulnerability in nearai ironclaw up to version 0.29.1 affecting the write_file tool. It involves improper path validation in the validate_path function of src/tools/builtin/path_utils.rs. The issue allows sandbox escape through dangling symlinks, where the validator checks the nearest existing ancestor but the final write follows the symlink to an external location. This enables arbitrary file writes outside the intended sandbox directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for IronClaw versions up to 0.29.1 using commands like 'ironclaw --version' or inspect installed packages. Look for suspicious file writes outside sandbox directories or unexpected symlink targets in paths processed by write_file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with local access to write files outside the sandboxed environment. This could lead to breaking project isolation, corrupting host files, or overwriting trusted configuration files. It may also enable unauthorized access to sensitive data if combined with other flaws in environment variable handling.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data through sandbox escape. If exploited, it may allow attackers to write files outside intended boundaries, potentially exposing or corrupting sensitive configuration files or credentials. This could lead to data breaches or unauthorized disclosure, violating GDPR's data protection principles or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 or upgrade to a version beyond 0.29.1. Review and restrict symlink handling in path validation and enforce strict sandbox boundaries for file operations.

Useful 0 Not Useful 0