CVE-2026-43989 Details
Description
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.
A vulnerability in the JunoClaw AI platform's upload_wasm tool, present in versions prior to 0.3.0, allowed for arbitrary file uploads without proper validation. The tool accepted unbounded filesystem paths, enabling the upload of files regardless of their location, symlink targets, sizes, or formats. This issue could be exploited by placing a symlink to a readable file under the operator's home directory, which would then be exfiltrated via on-chain MsgStoreCode bytes.
Users can upgrade to JunoClaw version 0.3.0 or later, which includes the necessary validation checks. Instructions for upgrading are available in the JunoClaw repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dragonmonk111/junoclaw/commit/a7886cd | [email protected] | Source CodeVendor |
| https://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1 | [email protected] | Release NotesVendor |
| https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-rw59-34hw-pmwp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JunoClaw | All versions |
CPE
Remediation
| |
| JunoClaw Cosmos MCP | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |