Is CVE-2026-15618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15618 being exploited in the wild.

How severe is CVE-2026-15618?

Medium severity, with a CVSS score of 6.3, published 14 July 2026.

Is there a fix for CVE-2026-15618?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15618 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15618?

Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15618: mosaxiv clawlet protection mechanism failure in guardExecCommand

CVE-2026-15618 · Severity: medium · CVSS 6.3 · Published 2026-07-14

Mosaxiv clawlet is an AI assistant tool that allows for the execution of system commands. A security flaw in its safety guard allows attackers to bypass command restrictions by wrapping dangerous commands inside other programs like Python. This could allow an attacker to delete files or execute unauthorized code on the system where the assistant is running, potentially leading to data loss or system compromise.

Technologies: Mosaxiv Clawlet. Vendors: Mosaxiv.

Quick answers

Is CVE-2026-15618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15618 being exploited in the wild.
How severe is CVE-2026-15618?: Medium severity, with a CVSS score of 6.3, published 14 July 2026.
Which products and versions are affected?: Mosaxiv Clawlet <= 0.2.10.
Is there a fix for CVE-2026-15618?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15618 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15618?: Check whether you run Mosaxiv Clawlet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A protection mechanism failure exists in the `guardExecCommand` function within `tools/tool_exec.go` (and `tools/exec_guard.go`) of mosaxiv clawlet. The safety guard uses regex-based denylisting to block dangerous shell commands like 'rm -rf', but it only evaluates the outer command string. An attacker can bypass these checks by wrapping malicious payloads inside inline interpreters (e.g., `python3 -c "..."`), which the guard does not normalize or unwrap. This allows for arbitrary command execution and filesystem modification within the workspace. The vulnerability is reachable via the exported `exec` tool interface, and while a GitHub issue was filed, the maintainers have marked it as 'not planned' for fixing.

Affected products

mosaxiv clawlet <= 0.2.10

Timeline

2026-07-14: disclosed
2026-07-14: advisory: GitHub issue closed as 'not planned'

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.