EUVD-2026-31886
GHSA-h75h-m8wx-2x9c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/bash.rs of the component Blacklist Handler. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in haojing8312 WorkClaw up to version 0.6.4 allows a low-privileged remote attacker to bypass the application's blacklist-based command filter and execute arbitrary operating system commands. The flaw resides in the is_dangerous function within the Rust/Tauri agent's bash tool (apps/runtime/src-tauri/src/agent/tools/bash.rs), where an incomplete blacklist fails to block crafted payloads. A publicly available proof-of-concept exploit exists via a GitHub issue report; no vendor patch has been released as the project has not responded to the disclosure.
Technical ContextAI
WorkClaw is a desktop application built on the Tauri framework (Rust backend, web frontend), as indicated by the src-tauri path in the affected file. It includes an AI agent subsystem capable of executing bash commands on the host OS. The security boundary for this capability is a blacklist handler - the is_dangerous function in bash.rs - which is meant to reject dangerous command strings before execution. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: the blacklist approach is inherently incomplete, and attackers can craft input that uses shell metacharacters, alternative command forms, or encoding tricks to bypass string-matching checks. The CPE cpe:2.3:a:haojing8312:workclaw:*:*:*:*:*:*:*:* confirms all versions of the haojing8312 WorkClaw application are in scope. CVSS 4.0 impact metrics (VC:L/VI:L/VA:L; SC:N/SI:N/SA:N) reflect low-rated impacts on the vulnerable system and no downstream component impact, possibly owing to Tauri's sandboxing context, though the practical severity of arbitrary command execution may exceed these ratings in practice.
RemediationAI
No vendor-released patch identified at time of analysis - the project maintainer (haojing8312) was notified via issue report but has not responded. The most effective compensating control is to disable or restrict the WorkClaw bash agent feature entirely if it is not operationally required, as this eliminates the attack surface at the feature level. Where the bash agent must remain active, restrict network access to the WorkClaw instance so that only trusted, authenticated users on controlled networks can reach it, reducing the practical impact of the low-privilege requirement (PR:L). Administrators should monitor the upstream GitHub repository at https://github.com/haojing8312/WorkClaw/ for any forthcoming patch release and apply it immediately upon availability. Given the blacklist-based flaw (CWE-78), a proper fix would require replacing the blacklist approach with an allowlist or sandboxed subprocess execution model - a partial blacklist patch would be insufficient. The VulDB advisory is available at https://vuldb.com/vuln/365627.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today