The flaw lies in the ExecTool.Execute function of the jq Handler in GoClaw, allowing an attacker to retrieve sensitive data through the manipulation of requests executed via that handler. The vulnerability can be triggered remotely and has a medium severity score of 5.3, indicating that it can expose confidential information without granting complete system control. The defect originates from insufficient input validation on the jq command execution path, leading to unintended disclosure of data that may be stored on the host or included in the command output.

The affected product is GoClaw from nextlevelbuilder, with vulnerable versions up to 3.13.2. All builds of GoClaw prior to the 1230 patch expose this weakness, regardless of deployment environment or operating system, since the ExecTool.Execute component is version‑specific.

The CVSS score of 5.3 reflects a medium risk, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog, yet an exploit has been published on public code repositories, meaning attackers could potentially use it against exposed instances of GoClaw that have not been patched. The attack vector is remote, and although the impact does not grant full system compromise, the potential for leaking sensitive data such as configuration files, environment variables, or logs remains a concern for affected organizations.