Erichen-Apple

**Name of the Vulnerable Software and Affected Versions** NousResearch hermes-agent versions prior to 0.16.1 **Description** A remote attack can lead to incorrect privilege assignment. This issue occurs within the `disabled toolsets` Handler, specifically affecting the `get tool definitions()` function located in the `agent/agent init.py` file. **Recommendations** Update NousResearch hermes-agent to a version later than 0.16.0. As a temporary workaround, restrict access to the `get tool definitions()` function in the `agent/agent init.py` file.

**Name of the Vulnerable Software and Affected Versions** nearai ironclaw versions prior to 0.29.2 **Description** A remote command injection issue exists within the `classify command risk()` function located in the `src/tools/builtin/shell.rs` file. This flaw allows a remote attacker to execute arbitrary commands on the system through manipulation of the affected function. **Recommendations** Apply patch a1d7c3ba428ed575900469b207fb5668725f9a71 to resolve the issue. As a temporary workaround, restrict access to the `classify command risk()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** nextlevelbuilder GoClaw versions prior to 3.13.3 **Description** A remote flaw exists in the jq Handler component within the `ExecTool.Execute()` function of the `goclaw/internal/http/tools invoke.go` file. A remote attacker can perform a manipulation that leads to information disclosure. **Recommendations** Apply patch 1230 to resolve the issue. As a temporary mitigation, restrict access to the `ExecTool.Execute()` function.

**Name of the Vulnerable Software and Affected Versions** AstrBotDevs AstrBot versions prior to 4.25.6 **Description** A security flaw in the Subagent component allows for incorrect authorization. The issue resides in the ` build handoff toolset()` function within the `AstrBot/astrbot/core/astr agent tool exec.py` file. This flaw can be exploited remotely. **Recommendations** Apply patch d23011262e8e75e1ec41b0f1f0091493a022327e to remediate the issue. As a temporary workaround, restrict access to the ` build handoff toolset()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** unitedbyai droidclaw versions prior to 0.5.4 **Description** An authorization bypass exists in the Unsigned Scheduled Callback component within the `server/src/routes/goals.ts` file. This flaw allows for remote exploitation, although the attack complexity is high and exploitation is considered difficult. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.