CVE-2026-16129

Name of the Vulnerable Software and Affected Versions princezuda SafestClaw versions prior to 4.2.5

Description An issue exists in the Built-in Web Interface within the ShellAction. validate command() function located in the src/safestclaw/actions/shell.py file. This flaw results in an incomplete blacklist, which could be exploited by a local attacker.

Recommendations Update princezuda SafestClaw to version 4.2.5 or later. As a temporary mitigation, restrict local access to the Built-in Web Interface or avoid using the ShellAction. validate command() function.