EUVD-2026-45390
GHSA-4ch8-fgcq-7558
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and low privilege confirmed by description and CVSS 4.0 source; scope unchanged; all impacts low, consistent with incomplete blacklist bypass within a single application.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: "On paper you're correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It's open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users."
AnalysisAI
Incomplete shell command blacklist validation in SafestClaw up to version 4.2.4 allows a local low-privilege attacker to bypass the ShellAction._validate_command restriction in the Built-in Web Interface, potentially executing unintended shell commands. A proof-of-concept has been publicly disclosed via GitHub issue #59, though the project maintainer actively disputes that the disclosed exploit demonstrates any concrete user-facing threat, noting the AI-generated POC fails to show actual harm and that the open-source codebase allows operators to customize or remove the allow list. No public exploit has been confirmed in CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the minimal assessed real-world impact.
Technical ContextAI
SafestClaw (CPE: cpe:2.3:a:princezuda:safestclaw:*:*:*:*:*:*:*:*) is an open-source project with a Built-in Web Interface that exposes shell command execution capabilities. The vulnerability resides in the ShellAction._validate_command method in src/safestclaw/actions/shell.py, which enforces command restrictions via a blacklist approach. CWE-184 (Incomplete List of Disallowed Inputs) captures this root cause class: blacklists are structurally weaker than allowlists because they must enumerate every forbidden input, making omissions inevitable. In this case, the incomplete blacklist may permit shell commands that were intended to be blocked, enabling bypass of the application's command gating logic. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the vulnerability is locally reachable with no special attack configuration required beyond holding a low-privilege account.
RemediationAI
No vendor-released patch has been confirmed for this vulnerability at time of analysis - the project maintainer has contested the validity of the reported issue and has not committed a fix version. Because SafestClaw is open source, the most direct compensating control is to manually extend or replace the blacklist in src/safestclaw/actions/shell.py with a strict allowlist of only explicitly required shell commands; this eliminates the CWE-184 root cause entirely and is the approach the maintainer implicitly endorses. If the shell action feature is not required, disabling or removing the ShellAction component from the deployment eliminates the attack surface with no functional side effects for users who do not rely on it. Restricting local system access to trusted users only reduces exploitation risk given the AV:L requirement. Monitor the GitHub repository at https://github.com/princezuda/safestclaw/ and VulDB entry https://vuldb.com/vuln/379845 for any future patch releases.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today