Executive brief
JunoClaw is an AI platform that allows automated agents to interact with system resources. A security flaw in its shell plugin allowed attackers to bypass command restrictions by using specifically crafted arguments. This could lead to unauthorized command execution on the host system, potentially resulting in full system compromise or data theft.
Technical details
The vulnerability (CWE-78, CWE-184) exists in the command-safety check of the plugin-shell component. Prior to the fix, the system used a substring-based blocklist applied to the raw command string rather than the parsed first token. This allowed attackers to bypass security restrictions using adversarial argument constructions or shell metacharacters. When combined with other vulnerabilities, this allows for arbitrary command execution on the host. The fix introduces a strict allowlist applied to parsed tokens, removes the shell wrapper in favor of direct process spawning, and adds a compile-time feature gate ('unsafe-shell') to disable these code paths entirely.
Affected products
- Dragonmonk111 JunoClaw plugin-shell < 0.x.y-security-1
Timeline
- 2026-04-26: advisory: Internal GHSA published
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 0.x.y-security-1