CVE-2026-43989

High

Description

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

SeverityHigh

CVSS8.5

Exploit probability—

ProductDragonmonk111 Junoclaw

PublishedMay 12, 2026

First seenMay 12, 2026

Weakness typeCWE-20Improper input validation CWE-22Path traversal CWE-59Improper link resolution CWE-73CWE-73

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
Dragonmonk111 junoclaw	< v0.x.y-security-1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.