crates.io/zeptoclaw: critical 10
zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
Action: Upgrade zeptoclaw to 0.6.2 or later.
cargo update -p zeptoclaw --precise 0.6.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.2 | - |
Fixed versions
| 0.6.2 |
Sources
- osv: GHSA-5wp8-q9mx-8jx8
- https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-5wp8-q9mx-8jx8
- https://github.com/qhkm/zeptoclaw/commit/68916c3e4f3af107f11940b27854fc7ef517058b
- https://github.com/qhkm/zeptoclaw
- https://github.com/qhkm/zeptoclaw/blob/fe2ef07cfec5bb46b42cdd65f52b9230c03e9270/src/security/shell.rs#L218-L243
published · modified · JSON