Executive brief
WorkClaw, an AI-powered productivity tool, contains a security flaw in how it handles system commands. The software's 'Blacklist Handler' fails to properly block dangerous commands, which could allow a remote attacker to execute malicious code on the underlying operating system. This could lead to unauthorized data access, system disruption, or complete takeover of the affected machine.
Technical details
An OS command injection vulnerability exists in haojing8312 WorkClaw up to version 0.6.4 within the `is_dangerous` function located in `apps/runtime/src-tauri/src/agent/tools/bash.rs`. The root cause is an incomplete blacklist (CWE-184) and permissive validation (CWE-183) that relies on naive substring matching. Attackers can bypass security checks using multiple spaces, absolute paths, line breaks, or quoted parameters (e.g., 'rm -rf /' or '/bin/rm'). This allows a remote authenticated user to execute arbitrary shell commands. While the issue was reported to the maintainers, no official patch has been released as of the advisory date.
Affected products
- haojing8312 WorkClaw up to 0.6.4
Timeline
- 2026-04-29: disclosed: Issue reported on GitHub repository
- 2026-05-26: advisory: VulDB and NVD publication