CVE-2026-43991: JunoClaw plugin-shell safety check bypass enables host command execution

Summary

CVE-2026-43991 affects JunoClaw, an agentic AI platform built on Juno Network, before 0.x.y-security-1. A substring-based blocklist in the plugin-shell command-safety check, applied to the raw command string rather than the parsed first token, can be bypassed by adversarial argument constructions. When combined with the companion advisory, this allows unauthorized command execution on the host.

Mitigation

This vulnerability is fixed in 0.x.y-security-1.

Topics

• AI agents

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek