Is there a public PoC exploit available for CVE-2026-16204?

Yes, a public proof-of-concept exploit is available for CVE-2026-16204. Prioritise patching immediately. EPSS: 0.3%.

rt-claw CVE-2026-16204

Q: What is the CVSS score of CVE-2026-16204?

CVE-2026-16204 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45415 LOW

Code Injection (CWE-94)

2026-07-19 VulDB

GHSA-xr38-w5rc-h3q4

RCE Code Injection Rt Claw Zevorn

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

CWE-94 code injection enabling RCE warrants C:H/I:H/A:H; UI:R reflects required user-triggered tool execution per CVSS 4.0 UI:P; PR:N as no attacker-side credentials required.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 19, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 19, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 19, 2026 - 02:46 vuln.today

CVE Published

Jul 19, 2026 - 01:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function tool_run_script_execute of the file claw/services/tools/script.c of the component Telegram-to-AI Tool Execution Flow. Performing a manipulation results in code injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-to-AI Tool Execution Flow. The vulnerable function tool_run_script_execute in claw/services/tools/script.c fails to sanitize attacker-controlled input before passing it to script execution logic. A public proof-of-concept exploit has been released via GitHub issue #138, and the vendor has not yet responded to disclosure - no patch is available at time of analysis.

Technical ContextAI

rt-claw (CPE: cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*) is a Telegram-to-AI bridge tool that routes Telegram messages into AI-driven tool execution pipelines. The vulnerable code path resides in claw/services/tools/script.c within the tool_run_script_execute function, which is responsible for handling script execution triggered by Telegram commands. CWE-94 (Improper Control of Generation of Code) indicates that the function incorporates user-supplied data into a script or command string without adequate neutralization, enabling injection of arbitrary code constructs. This class of vulnerability typically arises when dynamic script generation uses string concatenation with unsanitized input rather than parameterized invocation or strict allowlisting.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor has not responded to the coordinated disclosure submitted via GitHub issue #138 (https://github.com/zevorn/rt-claw/issues/138). As a primary compensating control, disable or remove the script execution feature (tool_run_script_execute) entirely if it is not operationally required; disabling this capability eliminates the vulnerable code path but may break AI tool-invocation workflows. If script execution must remain enabled, restrict Telegram bot access to a strict allowlist of trusted user IDs at the bot-token or middleware level to limit who can trigger the vulnerable flow. Additionally, sandbox the process running rt-claw (e.g., via a restricted container or systemd NoNewPrivileges/CapabilityBoundingSet drops) to contain the blast radius of any successful code injection. Monitor application logs for anomalous script payloads. Consumers should watch the upstream repository (https://github.com/zevorn/rt-claw/) and VulDB entry (https://vuldb.com/vuln/380020) for a patched release.