GHSA-2m67-cxxq-c3h8
NoneCVSS
—
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zeptoclaw | 0 | 0.7.6 |
Related vulnerabilities
- CVE-2026-32232 ZeptoClaw is a personal AI assistant. Same vulnerability
- CVE-2026-32231 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation Also affects zeptoclaw
- GHSA-46q5-g3j9-wx5c ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is… Also affects zeptoclaw
- GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file… Also affects zeptoclaw
- GHSA-hhjv-jq77-cmvx zeptoclaw has Android device shell blocklist bypass via argument permutation Also affects zeptoclaw
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22