CVE-2026-32232
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Mar 12, 2026
CISA due date
—
The record
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zeptoclaw | 0 | 0.7.6 |
Related vulnerabilities
- GHSA-2m67-cxxq-c3h8 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink Same vulnerability
- CVE-2026-32231 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation Also affects zeptoclaw
- GHSA-46q5-g3j9-wx5c ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is… Also affects zeptoclaw
- GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file… Also affects zeptoclaw
- GHSA-hhjv-jq77-cmvx zeptoclaw has Android device shell blocklist bypass via argument permutation Also affects zeptoclaw
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22