CVE-2026-43991

Name of the Vulnerable Software and Affected Versions JunoClaw versions prior to 0.x.y-security-1

Description A substring-based blocklist in the plugin-shell command-safety check can be bypassed using adversarial argument constructions. This occurs because the check is applied to the raw command string instead of the parsed first token, which may allow unauthorized command execution on the host.

Recommendations Update to version 0.x.y-security-1.