CVE-2026-43990

Name of the Vulnerable Software and Affected Versions JunoClaw versions prior to 0.x.y-security-1

Description The run command function in the plugin-shell component wraps agent-supplied commands using 'sh -c' or 'cmd /C' and passes the full argument string to the shell parser. This allows shell metacharacters within agent-supplied arguments to be interpreted as command syntax, potentially leading to arbitrary command execution.

Recommendations Update to version 0.x.y-security-1.