CVE-2026-16130 Overview
CVE-2026-16130 is a link following vulnerability [CWE-59] in the nearai ironclaw project, affecting versions up to 0.29.1. The flaw resides in the validate_path function of src/tools/builtin/path_utils.rs within the write_file component. An attacker with local access can manipulate symbolic links to influence file write operations outside intended paths. The exploit code has been disclosed publicly, though there is no evidence of active exploitation. Maintainers have released a fix identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255.
Critical Impact
A local attacker can leverage symlink manipulation in the write_file tool to bypass path validation, potentially affecting file integrity and availability within the ironclaw sandbox.
Affected Products
- nearai ironclaw up to and including version 0.29.1
- Component: write_file tool in src/tools/builtin/path_utils.rs
- Fixed in commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255
Discovery Timeline
- 2026-07-18 - CVE-2026-16130 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16130
Vulnerability Analysis
The vulnerability exists in the path validation logic used by the write_file builtin tool in ironclaw. The validate_path function in src/tools/builtin/path_utils.rs inspects filesystem metadata to detect symbolic links before permitting a write. The original implementation collapsed error handling from symlink_metadata into a single boolean, treating any metadata failure as a non-symlink condition. This behavior enabled scenarios in which a symlink target could be followed rather than rejected, weakening the sandbox around file write operations.
A related shell wrapper regression in src/tools/builtin/shell.rs allowed env -S and --split-string invocations to bypass tokenized command inspection, further expanding the local attack surface.
Root Cause
The root cause is improper handling of symbolic link metadata during path resolution [CWE-59]. When the resolved path did not exist, the original code silently ignored metadata errors, failing to distinguish between a missing file and a dangling or maliciously crafted symlink. This allowed link following to occur under conditions the sandbox intended to block.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker who can influence filesystem paths passed to the write_file tool places or races a symlink to redirect the write operation. The impact is limited to integrity and availability of files reachable by the ironclaw process.
// Security patch in src/tools/builtin/path_utils.rs
// Source: https://github.com/nearai/ironclaw/commit/369ff3d240cf3c0787b50e1e9f182e1a06c71255
// all `..` components, so starts_with is reliable.
let check_path = if resolved.exists() {
resolved.canonicalize().unwrap_or_else(|_| resolved.clone())
- } else if std::fs::symlink_metadata(&resolved)
- .map(|m| m.file_type().is_symlink())
- .unwrap_or(false)
- {
+ } else if match std::fs::symlink_metadata(&resolved) {
+ Ok(metadata) => metadata.file_type().is_symlink(),
+ Err(err) if err.kind() == std::io::ErrorKind::NotFound => false,
+ Err(err) => {
+ return Err(ToolError::ExecutionFailed(format!(
+ "Failed to inspect path metadata for {}: {}",
+ path_str, err
+ )));
+ }
+ } {
return Err(ToolError::NotAuthorized(format!(
"Path is a dangling symlink: {}",
path_str
The patch replaces the silent unwrap_or(false) with explicit error handling. Only NotFound is treated as "not a symlink"; all other metadata errors now surface as ExecutionFailed, preventing the sandbox from silently accepting ambiguous paths.
Detection Methods for CVE-2026-16130
Indicators of Compromise
- Unexpected symbolic links placed inside directories accessed by the ironclaw write_file tool.
- File write operations targeting paths outside the ironclaw working directory or sandbox root.
- Error logs from ironclaw referencing Path is a dangling symlink or metadata inspection failures.
Detection Strategies
- Audit filesystem activity from processes running ironclaw for symlink(2) and symlinkat(2) syscalls preceding writes.
- Compare ironclaw binary and library versions against 0.29.1 to identify unpatched deployments.
- Correlate shell tool invocations that include env -S or --split-string arguments with subsequent file writes.
Monitoring Recommendations
- Enable Linux audit rules on directories writable by ironclaw to log create, symlink, and rename operations.
- Monitor process trees where the ironclaw process spawns shell wrappers and record command-line arguments.
- Alert on write operations that traverse symlinks resolving outside the expected sandbox root.
How to Mitigate CVE-2026-16130
Immediate Actions Required
- Upgrade ironclaw to a version that includes commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 or later.
- Restrict local access to systems running ironclaw to trusted users only.
- Review directories used by the write_file tool and remove untrusted symbolic links.
Patch Information
The fix is committed to the ironclaw repository. Refer to the GitHub Commit Details, the GitHub Pull Request, and the GitHub Issue Tracker. Additional details are available in the VulDB CVE Record.
Workarounds
- Run ironclaw under a dedicated low-privilege user account with a restricted working directory.
- Mount the ironclaw sandbox directory with nosymfollow where the operating system supports it.
- Disable or gate the write_file builtin tool until the patched release is deployed.
# Configuration example: run ironclaw in an isolated directory with restrictive permissions
install -d -m 0700 -o ironclaw -g ironclaw /var/lib/ironclaw/sandbox
mount -o remount,nosuid,nodev,nosymfollow /var/lib/ironclaw/sandbox
sudo -u ironclaw ironclaw --workdir /var/lib/ironclaw/sandbox
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
