CVE-2026-19008 mf-yang CVE debrief

Who should care

Users of mf-yang openclaw-cn up to version 0.2.1 should verify their inventory and monitor for potential attacks. Affected operators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Vulnerability management teams should consider compensating controls for link following vulnerabilities.

Technical summary

The function assertNoSymlinkEscape in src/agents/sandbox-paths.ts of mf-yang openclaw-cn up to 0.2.1 is vulnerable to link following. This issue can be exploited remotely. The vulnerability allows an attacker to follow links, potentially leading to unauthorized access or data breaches. The affected component is part of the apply_patch tool. Users of mf-yang openclaw-cn up to version 0.2.1 should verify their inventory and monitor project response and remediation status.

Defensive priority

Low-priority defensive review recommended due to limited details and low CVSS score.

Recommended defensive actions

• Verify inventory for affected versions of mf-yang openclaw-cn up to 0.2.1
• Monitor project response and remediation status
• Consider compensating controls for link following vulnerabilities
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The evidence for this CVE is limited. The project was informed of the problem early through an issue report but has not responded yet. Users should verify affected scope and vendor remediation status. The exploit is publicly available and might be used. Verify inventory for affected versions of mf-yang openclaw-cn up to 0.2.1 and monitor project response and remediation status.

Official resources