WorkClaw EUVD-2026-31886

The WorkClaw bash agent feature must be active and accessible - this is the component containing the vulnerable is_dangerous blacklist function in apps/runtime/src-tauri/src/agent/tools/bash.rs. The CVSS vector specifies PR:L (low privileges required), meaning the attacker must hold at least a low-privileged authenticated session within the WorkClaw application. AV:N confirms the exploit is reachable over the network. No special non-default configuration is implied beyond the bash agent feature being enabled. Exploitation is limited by the requirement for authenticated access (PR:L) - unauthenticated exploitation is not supported by the CVSS vector. The practical impact is further limited by the low CIA impact ratings in the CVSS 4.0 scoring, though this should be independently verified against the actual OS privilege level of the WorkClaw process in a given deployment.

Despite the CWE-78 classification (OS command injection) which typically warrants high severity, the CVSS 4.0 base score is only 2.1, driven by low CIA impact ratings (VC:L/VI:L/VA:L) and no subsequent component impact (SC:N/SI:N/SA:N). This discrepancy warrants scrutiny - command injection vulnerabilities almost universally enable significant host compromise, and the low impact scores may reflect an assessor assumption about Tauri sandboxing or limited process privileges. Security teams should verify whether the WorkClaw agent process runs with restricted OS privileges before accepting the low CVSS score at face value. The EPSS score of 0.86% at the 75th percentile indicates moderate relative interest among all CVEs, though absolute exploitation probability remains low. KEV status is not confirmed - this is NOT listed in CISA KEV, so active exploitation is not confirmed. However, a public POC exists (GitHub issue #4), which lowers the bar for exploitation. The CVSS vector includes E:P (proof-of-concept exploit exists), consistent with the known disclosure. The combination of network-accessible attack vector (AV:N), low privilege requirement (PR:L), no user interaction (UI:N), and a live POC makes this more actionable than the raw score suggests, particularly for organizations where WorkClaw is deployed in multi-user or networked environments.

An attacker with a low-privileged account on a WorkClaw instance submits a crafted bash command string to the agent's command execution interface, bypassing the is_dangerous blacklist check through shell metacharacter injection or command chaining techniques documented in the publicly available proof-of-concept at https://github.com/haojing8312/WorkClaw/issues/4. The injected command executes on the host OS under the WorkClaw process context, enabling file access, lateral movement, or further exploitation depending on the process's OS-level privileges. Because the attack requires no user interaction and operates over the network, it can be performed remotely by any user who has obtained low-privileged credentials.