EUVD-2026-53699
GHSA-cw23-qwr7-c655
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable injection requiring low-privilege authentication; sandboxed environment constrains all impacts to Low with no scope change to other systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is a1d7c3ba428ed575900469b207fb5668725f9a71. Applying a patch is advised to resolve this issue.
AnalysisAI
Command injection in nearai ironclaw up to version 0.29.1 allows remote attackers with low-privilege authenticated access to bypass the shell command risk classifier by supplying crafted shell metacharacters, quotes, or escape sequences to the classify_command_risk function in src/tools/builtin/shell.rs. The classifier's naive string analysis fails to account for proper shell tokenization, enabling malicious commands to be categorized as safe and subsequently executed by the agent's built-in shell tool. A public proof-of-concept exploit exists (GitHub issue #4862); the vulnerability is not listed in CISA KEV, and all impact dimensions are rated Low, consistent with a sandbox-constrained environment rather than full system compromise.
Technical ContextAI
nearai ironclaw is a Rust-based AI agent framework. The affected function, classify_command_risk in src/tools/builtin/shell.rs (CPE: cpe:2.3:a:nearai:ironclaw:*:*:*:*:*:*:*:*, all versions up to 0.29.1), is responsible for evaluating whether shell commands submitted to the agent's tool environment are safe to execute. The root cause is CWE-77: Improper Neutralization of Special Elements used in a Command - the function performed pattern-matching on raw shell input without a proper tokenizer, so an attacker could use shell quoting (single quotes, double quotes) or backslash escapes to cause the classifier to misparse a dangerous command segment as benign. The patch (commit a1d7c3ba428ed575900469b207fb5668725f9a71, PR #4869) remedies this by introducing a full shell_tokens() function that handles quoting states, escape sequences, and whitespace splitting before risk evaluation, along with helpers command_basename(), is_env_assignment(), and shell_script_arg(). The same PR also addresses a separate dangling symlink escape in path_utils.rs and file.rs, indicating multiple security issues were bundled in this fix.
RemediationAI
The upstream fix is available as commit a1d7c3ba428ed575900469b207fb5668725f9a71 via PR #4869 (https://github.com/nearai/ironclaw/pull/4869); however, an exact tagged release version incorporating this fix has not been independently confirmed from the available data - verify the patched release tag against the nearai ironclaw GitHub releases page before deploying. As a compensating control prior to patching, restrict access to the ironclaw agent API to the minimum set of trusted, authenticated principals, and disable the built-in shell tool in agent configuration if shell execution is not operationally required - removing the shell tool surface eliminates the vulnerable code path entirely, though this will break any agent workflows dependent on shell command execution. Network-level controls that limit which clients can reach the agent API also reduce exposure.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today