CVE-2026-43990: JunoClaw plugin-shell command injection through run_command arguments

Summary

CVE-2026-43990 affects JunoClaw, an agentic AI platform built on Juno Network, prior to 0.x.y-security-1. The plugin-shell run_command function wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell parser, so shell metacharacters in agent-supplied arguments were interpreted as command syntax. The issue is classified as CWE-77 and CWE-78, and NVD published it on 05/12/2026.

Mitigation

This vulnerability is fixed in 0.x.y-security-1.

Topics

• AI agents

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek