CVE-2026-43991 Details

A command injection vulnerability has been identified in the JunoClaw AI platform, specifically within the plugin-shell component, in versions prior to 0.x.y-security-1. The issue arises from a substring-based blocklist in the command-safety check, which could be bypassed using adversarial argument constructions. This flaw allowed unauthorized command execution on the host, particularly when combined with certain advisory details. The vulnerability existed because the safety check was applied to the raw command string instead of the parsed first token, leaving room for exploitation.

Users can upgrade to JunoClaw version 0.x.y-security-1 or later to address this vulnerability. Instructions for updating can be found in the JunoClaw repository on GitHub.