A security vulnerability has been detected in nanocoai NanoClaw up to 2.0.64. This affects an unknown part of the file container/agent-runner/src/mcp-tools/core…

A path traversal vulnerability has been identified in nanocoai NanoClaw versions up to 2.0.64. The flaw exists in the file container/agent-runner/src/mcp-tools/core.ts within the send_file component. An attacker can exploit this vulnerability remotely to traverse directory paths beyond intended boundaries. A public exploit has been disclosed, increasing the risk of active exploitation. The project maintainers were notified via an issue report but have not yet responded or released a patch. The vulnerability is tracked as CVE-2026-18991 and is listed on NVD and VulDB. Users of affected versions should consider mitigating controls until an official fix is available.