Ironclaw
Monthly
Command injection in nearai ironclaw up to version 0.29.1 allows remote attackers with low-privilege authenticated access to bypass the shell command risk classifier by supplying crafted shell metacharacters, quotes, or escape sequences to the classify_command_risk function in src/tools/builtin/shell.rs. The classifier's naive string analysis fails to account for proper shell tokenization, enabling malicious commands to be categorized as safe and subsequently executed by the agent's built-in shell tool. A public proof-of-concept exploit exists (GitHub issue #4862); the vulnerability is not listed in CISA KEV, and all impact dimensions are rated Low, consistent with a sandbox-constrained environment rather than full system compromise.
Symlink following in nearai ironclaw up to 0.29.1 allows a local low-privileged user to redirect the write_file built-in tool's output to arbitrary files outside the agent's sandbox directory. The root cause is that the validate_path function in src/tools/builtin/path_utils.rs used metadata resolution that follows symlinks rather than symlink_metadata, permitting a dangling symlink inside the sandbox to pass validation and cause the subsequent write to land on an out-of-sandbox target. No confirmed active exploitation (not in CISA KEV) but a public proof-of-concept is referenced at GitHub issue #4797, and EPSS data was not supplied.
Command injection in nearai ironclaw up to version 0.29.1 allows remote attackers with low-privilege authenticated access to bypass the shell command risk classifier by supplying crafted shell metacharacters, quotes, or escape sequences to the classify_command_risk function in src/tools/builtin/shell.rs. The classifier's naive string analysis fails to account for proper shell tokenization, enabling malicious commands to be categorized as safe and subsequently executed by the agent's built-in shell tool. A public proof-of-concept exploit exists (GitHub issue #4862); the vulnerability is not listed in CISA KEV, and all impact dimensions are rated Low, consistent with a sandbox-constrained environment rather than full system compromise.
Symlink following in nearai ironclaw up to 0.29.1 allows a local low-privileged user to redirect the write_file built-in tool's output to arbitrary files outside the agent's sandbox directory. The root cause is that the validate_path function in src/tools/builtin/path_utils.rs used metadata resolution that follows symlinks rather than symlink_metadata, permitting a dangling symlink inside the sandbox to pass validation and cause the subsequent write to land on an out-of-sandbox target. No confirmed active exploitation (not in CISA KEV) but a public proof-of-concept is referenced at GitHub issue #4797, and EPSS data was not supplied.