CVE-2026-43989

—

CVSS 3.1

8.5 high

EPSS

<1%p4

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Weakness: CWE-20, CWE-22, CWE-59, CWE-73
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.