CVE-2026-18038

Medium

Description

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/tools_invoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1230. It is advisable to implement a patch to correct this issue.

SeverityMedium

CVSS4.3

Exploit probability—

ProductNextlevelbuilder Goclaw

PublishedJul 28, 2026

First seenJul 28, 2026

Weakness typeCWE-200Sensitive information exposure CWE-284Improper access control

How to fix

Patches

github.com/nextlevelbuilder/goclaw/pull/1230

Affected products

Product	Affected versions	Fixed in
nextlevelbuilder goclaw	3.13.0, 3.13.1, 3.13.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.