Executive brief
JunoClaw is an AI platform that allows automated agents to perform tasks. A security flaw in its shell plugin allowed these agents to execute unintended system commands by using special characters. This could allow an attacker to gain full control over the underlying system, leading to data theft or service disruption.
Technical details
The JunoClaw `plugin-shell` component is vulnerable to OS command injection (CWE-78). Prior to version v0.x.y-security-1, the `run_command` function wrapped agent-supplied input in 'sh -c' (on Linux) or 'cmd /C' (on Windows). Because the full argument string was passed directly to the shell's parser without sufficient sanitization, an attacker could use shell metacharacters to execute arbitrary commands. The fix involves removing the shell wrapper in favor of direct process execution via `std::process::Command::spawn`, implementing a strict command allowlist, and introducing a compile-time feature gate (`unsafe-shell`) that is disabled by default.
Affected products
- JunoClaw plugin-shell < v0.x.y-security-1
Timeline
- 2026-04-26: patched: Fix committed and release v0.x.y-security-1 published.
- 2026-05-12: disclosed: CVE published to NVD.