Vulnerability Description
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Dragonmonk111/junoclaw/commit/a7886cd
- https://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1
- https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-rw59-34hw-pmw
FAQ
What is CVE-2026-43989?
CVE-2026-43989 is a vulnerability with a CVSS score of 8.5 (HIGH). JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to...
How severe is CVE-2026-43989?
CVE-2026-43989 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-43989?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.