CVE-2026-18980

Name of the Vulnerable Software and Affected Versions nearai ironclaw versions prior to 0.29.2

Description A remote command injection issue exists within the classify command risk() function located in the src/tools/builtin/shell.rs file. This flaw allows a remote attacker to execute arbitrary commands on the system through manipulation of the affected function.

Recommendations Apply patch a1d7c3ba428ed575900469b207fb5668725f9a71 to resolve the issue. As a temporary workaround, restrict access to the classify command risk() function to minimize the risk of exploitation.