GHSA-hhjv-jq77-cmvx
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 5, 2026
CISA due date
—
The record
zeptoclaw has Android device shell blocklist bypass via argument permutation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | zeptoclaw | 0 | 0.6.2 |
Related vulnerabilities
- CVE-2026-32231 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- CVE-2026-32232 ZeptoClaw is a personal AI assistant. Also affects zeptoclaw
- GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation Also affects zeptoclaw
- GHSA-2m67-cxxq-c3h8 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink Also affects zeptoclaw
- GHSA-46q5-g3j9-wx5c ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is… Also affects zeptoclaw
- GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file… Also affects zeptoclaw
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78