Executive brief
ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
Affected products
- crates.io zeptoclaw
Junglewise Threat Intelligence
ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
Severity: low · CVSS 3.1 · Published 2026-03-12
Technologies: zeptoclaw (crates.io). Vendors: crates.io.
Related threats
- ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
- ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
- zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
- zeptoclaw has Android device shell blocklist bypass via argument permutation