Description
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The handleNavigate function in nextlevelbuilder GoClaw allows an attacker to supply a crafted targetUrl argument that results in the disclosure of sensitive data processed by the tool. The flaw does not permit code execution or denial of service; it solely exposes information, satisfying CWE-200 and CWE-284 characteristics of information disclosure and insufficient access control.

Affected Systems

Versions of GoClaw up to 3.13.3‑beta.3 are affected. The vulnerability resides in pkg/browser/tool.go and affects all deployments of the nextlevelbuilder GoClaw repository that use these releases.

Risk and Exploitability

The CVSS score of 5.3 places the issue in the moderate range, while an EPSS of <1% suggests a low likelihood of exploitation in the wild. The flaw can be exploited remotely by sending a crafted request that manipulates the targetUrl; it is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on July 31, 2026 at 10:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a GoClaw release newer than 3.13.3‑beta.3 that contains the fix.
  • Apply network controls or firewall rules to restrict access to the GoClaw service to trusted hosts.
  • Validate or sanitize the targetUrl input within GoClaw, ensuring only expected URLs or formats are accepted to prevent arbitrary disclosure.

Generated by OpenCVE AI on July 31, 2026 at 10:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used.
Title nextlevelbuilder GoClaw tool.go handleNavigate information disclosure
First Time appeared Nextlevelbuilder
Nextlevelbuilder goclaw
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:nextlevelbuilder:goclaw:*:*:*:*:*:*:*:*
Vendors & Products Nextlevelbuilder
Nextlevelbuilder goclaw
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nextlevelbuilder Goclaw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T14:30:28.535Z

Reserved: 2026-07-13T17:24:16.907Z

Link: CVE-2026-15627

cve-icon Vulnrichment

Updated: 2026-07-14T13:01:51.913Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:00:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control