CVE-2026-18980: nearai ironclaw RCE Vulnerability

CVE-2026-18980 Overview

CVE-2026-18980 is a command injection vulnerability [CWE-74] affecting nearai ironclaw versions up to 0.29.1. The flaw resides in the classify_command_risk function of src/tools/builtin/shell.rs, where insufficient validation of tool boundaries allows attackers to inject commands processed by the shell tool. The vulnerability is remotely exploitable and requires low-privileged access, and a public exploit has been referenced by third-party sources. The maintainers released a fix under patch commit a1d7c3ba428ed575900469b207fb5668725f9a71, which introduces stricter path and symlink handling to enforce sandbox boundaries.

Critical Impact
Remote attackers with low privileges can inject commands through the shell tool's risk classification path, bypassing intended sandbox boundaries and affecting confidentiality, integrity, and availability of the host.

Affected Products

nearai ironclaw versions up to and including 0.29.1
Component: src/tools/builtin/shell.rs (classify_command_risk function)
Related component: src/tools/builtin/path_utils.rs (symlink boundary handling)

Discovery Timeline

2026-08-06 - CVE-2026-18980 published to NVD
2026-08-06 - Last updated in NVD database
Patch reference - Commit a1d7c3ba428ed575900469b207fb5668725f9a71 merged via GitHub Pull Request #4869

Technical Details for CVE-2026-18980

Vulnerability Analysis

The vulnerability originates in the classify_command_risk function inside src/tools/builtin/shell.rs. This function is responsible for evaluating whether a shell invocation is safe to execute within the ironclaw agent's tool boundary. Insufficient validation of command inputs and adjacent file-system primitives allows an attacker to inject commands or manipulate path resolution to escape the intended sandbox. The upstream fix, tracked in GitHub Issue #4861 and GitHub Issue #4862, tightens tool boundary checks so that shell and file tools reject inputs that resolve outside the sandbox base directory.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream component [CWE-74]. The classifier trusted command and path inputs without fully resolving them against the sandbox base directory, and dangling symlinks were not treated as unsafe. This allowed crafted paths and command fragments to redirect execution or writes to targets outside the sandbox.

Attack Vector

Exploitation occurs over the network against an ironclaw agent that exposes tool APIs to a low-privileged caller. An attacker submits crafted arguments to a shell or file tool operation whose classification logic fails to reject the malicious payload. The result is command injection with the privileges of the ironclaw process, plus the ability to write through dangling symlinks into locations outside the sandbox.

rust

// Patch excerpt: src/tools/builtin/path_utils.rs
// Reject dangling symlinks during path resolution
let check_path = if resolved.exists() {
    resolved.canonicalize().unwrap_or_else(|_| resolved.clone())
} else if match std::fs::symlink_metadata(&resolved) {
    Ok(metadata) => metadata.file_type().is_symlink(),
    Err(err) if err.kind() == std::io::ErrorKind::NotFound => false,
    Err(err) => {
        return Err(ToolError::ExecutionFailed(format!(
            "Failed to inspect path metadata for {}: {}",
            path_str, err
        )));
    }
} {
    return Err(ToolError::NotAuthorized(format!(
        "Path is a dangling symlink: {}",
        path_str
    )));
} else {
    // Walk up to the nearest existing ancestor directory, canonicalize it,
    // then re-append the remaining tail.
};
// Source: https://github.com/nearai/ironclaw/commit/a1d7c3ba428ed575900469b207fb5668725f9a71

rust

// Patch excerpt: src/tools/builtin/file.rs
// Regression test asserting writes through dangling symlinks are rejected
#[cfg(unix)]
#[tokio::test]
async fn test_write_file_rejects_dangling_final_symlink() {
    use std::os::unix::fs::symlink;

    let sandbox = TempDir::new().unwrap();
    let outside = TempDir::new().unwrap();
    let outside_target = outside.path().join("owned.txt");
    symlink(&outside_target, sandbox.path().join("jump")).unwrap();

    let tool = WriteFileTool::new().with_base_dir(sandbox.path().to_path_buf());
    let ctx = JobContext::default();

    let result = tool
        .execute(
            serde_json::json!({
                "path": "jump",
                "content": "pwned"
            }),
            &ctx,
        )
        .await;

    assert!(result.is_err());
    assert!(!outside_target.exists());
}
// Source: https://github.com/nearai/ironclaw/commit/a1d7c3ba428ed575900469b207fb5668725f9a71

Detection Methods for CVE-2026-18980

Indicators of Compromise

Unexpected child processes spawned by the ironclaw agent process, particularly shell interpreters invoked with concatenated argument strings.
File writes or reads by the ironclaw process to paths outside its configured sandbox base directory.
Creation or use of symlinks inside the sandbox whose targets resolve to system directories such as /etc, /root, or user home directories.

Detection Strategies

Audit ironclaw tool invocations for shell commands containing metacharacters such as ;, &&, |, backticks, or $(...) sequences reaching the classify_command_risk code path.
Compare deployed ironclaw versions against the fixed release built from commit a1d7c3ba428ed575900469b207fb5668725f9a71.
Review agent logs for ToolError::NotAuthorized entries referencing dangling symlinks, which indicate the patched code is actively blocking boundary violations.

Monitoring Recommendations

Monitor process ancestry for ironclaw spawning /bin/sh, /bin/bash, or cmd.exe with attacker-controlled arguments.
Alert on file system events where the ironclaw process opens or writes to paths outside its sandbox base directory.
Track network-exposed ironclaw endpoints for anomalous tool-call volumes from low-privileged callers.

How to Mitigate CVE-2026-18980

Immediate Actions Required

Upgrade ironclaw to a release that includes commit a1d7c3ba428ed575900469b207fb5668725f9a71 from Pull Request #4869.
Restrict network exposure of ironclaw agents so that only trusted callers can reach tool endpoints.
Review historical logs for evidence of prior exploitation attempts against the shell and file tools.

Patch Information

The fix is delivered in commit a1d7c3ba428ed575900469b207fb5668725f9a71 titled "fix(security): tool boundary checks". The patch strengthens path_utils.rs to reject dangling symlinks and adds regression tests in file.rs verifying that writes through symlinks pointing outside the sandbox base directory are refused. See the GitHub commit a1d7c3b and the VulDB entry for CVE-2026-18980 for full details.

Workarounds

Run the ironclaw agent under a dedicated low-privilege system account with mandatory access controls (AppArmor, SELinux, or seccomp) constraining shell execution.
Disable or gate the shell tool for untrusted callers until the patched version is deployed.
Place ironclaw's working directory on a dedicated filesystem or bind mount to reduce blast radius from sandbox escapes.

bash

# Verify the deployed ironclaw build includes the security patch
git -C /opt/ironclaw log --oneline | grep a1d7c3ba428ed575900469b207fb5668725f9a71

# Example systemd hardening for the ironclaw service
# /etc/systemd/system/ironclaw.service.d/hardening.conf
[Service]
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/ironclaw/sandbox
RestrictSUIDSGID=true