CVE-2026-16120

MEDIUM 6.3

nextlevelbuilder GoClaw exec_approval.go extractBin name resolution

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to incorrectly-resolved name. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CWE	CWE-706
Vendor	nextlevelbuilder
Product	goclaw
Published	Jul 18, 2026

Stay Ahead of the Next One

Get instant alerts for nextlevelbuilder goclaw

Be the first to know when new medium vulnerabilities affecting nextlevelbuilder goclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

nextlevelbuilder / GoClaw

3.13.3-beta.0 3.13.3-beta.1 3.13.3-beta.2 3.13.3-beta.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/379829 vuldb.com: https://vuldb.com/vuln/379829/cti vuldb.com: https://vuldb.com/cve/CVE-2026-16120 vuldb.com: https://vuldb.com/submit/856826 github.com: https://github.com/nextlevelbuilder/goclaw/issues/1213 github.com: https://github.com/nextlevelbuilder/goclaw/issues/1213#issuecomment-4760246569 github.com: https://github.com/nextlevelbuilder/goclaw/

Credits

🔍 Erichen (VulDB User)