Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N L N N L L 1.9 .0014 3.6 —
AFFECTED Product Versions Fixed ironclaw 0.29.0 – —
TIMELINE Jul 17 Reserved by VulDB Jul 18 EXPLOIT PUBLISHED — CVE-2026-16130 (nearai ironclaw). Public exploit reference added. Jul 18 Published (CNA: VulDB) Jul 20 RESCORED — CVE-2026-16130 (nearai ironclaw). CVSS 4.8 → 1.9 (NVD).
A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local access is required to approach this attack. The exploit is publicly available and might be used. The identifier of the patch is 369ff3d240cf3c0787b50e1e9f182e1a06c71255. It is recommended to apply a patch to fix this issue.
| Date | Event | Detail |
|---|---|---|
| July 17, 2026 | Reserved | Reserved by VulDB |
| July 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-16130 (nearai ironclaw). Public exploit reference added. |
| July 18, 2026 | Published | Published (CNA: VulDB) |
| July 20, 2026 | RESCORED | RESCORED — CVE-2026-16130 (nearai ironclaw). CVSS 4.8 → 1.9 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| nearai | ironclaw | — | 0.29.0 | — |
Authoritative record: CVE-2026-16130 at cve.org
Vendors: nearai
Weaknesses: CWE-59
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-16130 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.