GHSA-5wp8-q9mx-8jx8
Critical · 10.0CVSS
10.0
EPSS
—
Published
Mar 5, 2026
CISA due date
—
The record
zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zeptoclaw | 0 | 0.6.2 |
Related vulnerabilities
- CVE-2026-32231 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- CVE-2026-32232 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation Also affects zeptoclaw
- GHSA-2m67-cxxq-c3h8 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink Also affects zeptoclaw
- GHSA-46q5-g3j9-wx5c ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is… Also affects zeptoclaw
- GHSA-hhjv-jq77-cmvx zeptoclaw has Android device shell blocklist bypass via argument permutation Also affects zeptoclaw
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
- CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77