Executive brief
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
Affected products
- crates.io zeptoclaw
Junglewise Threat Intelligence
CVE-2026-32232: ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
CVE-2026-32232 · Severity: medium · CVSS 4 · Published 2026-03-12
Technologies: zeptoclaw (crates.io). Vendors: crates.io.
Related threats
- ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
- ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
- zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
- zeptoclaw has Android device shell blocklist bypass via argument permutation