CVE-2026-9565
haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection
CVSS Score
6.3
EPSS Score
0.9%
EPSS Percentile
75th
A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/bash.rs of the component Blacklist Handler. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-78 CWE-77 |
| Vendor | haojing8312 |
| Product | workclaw |
| Published | May 26, 2026 |
| Last Updated | May 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for haojing8312 workclaw
Be the first to know when new medium vulnerabilities affecting haojing8312 workclaw are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
haojing8312 / WorkClaw
0.6.0 0.6.1 0.6.2 0.6.3 0.6.4
References
Credits
🔍 ybdesire (VulDB User) VulDB CNA Team