A remote OS command injection vulnerability (CVE-2026-10219) was discovered in nextlevelbuilder GoClaw versions up to 3.11.3. The vulnerability affects the FsBridge.WriteFile function in the internal/sandbox/fsbridge.go file of the write_file Tool component. Attackers can exploit this vulnerability remotely through manipulation to achieve command injection. The exploit has been publicly disclosed and is available for use. A pull request containing a fix has been submitted but is still awaiting acceptance, leaving systems vulnerable in the interim.