GHSA-46q5-g3j9-wx5c
High · 8.2CVSS
8.2
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zeptoclaw | 0 | 0.7.6 |
Related vulnerabilities
- CVE-2026-32231 ZeptoClaw is a personal AI assistant. Same vulnerability
- CVE-2026-32232 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation Also affects zeptoclaw
- GHSA-2m67-cxxq-c3h8 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink Also affects zeptoclaw
- GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file… Also affects zeptoclaw
- GHSA-hhjv-jq77-cmvx zeptoclaw has Android device shell blocklist bypass via argument permutation Also affects zeptoclaw
- CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306