CVE-2026-43990

{
  "id": "CVE-2026-43990",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T17:16:20.953",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1."
    },
    {
      "lang": "es",
      "value": "JunoClaw es una plataforma de IA agéntica construida sobre Juno Network. Antes de 0.x.y-security-1, el run_command de plugin-shell envolvía cada comando proporcionado por el agente en ’sh -c’ / ’cmd /C’ y pasaba la cadena completa de argumentos al analizador del shell, permitiendo que los metacaracteres del shell en los argumentos proporcionados por el agente fueran interpretados como sintaxis de comando. Esta vulnerabilidad está corregida en 0.x.y-security-1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dragonmonk111",
          "product": "junoclaw",
          "versions": [
            {
              "version": "< v0.x.y-security-1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T19:01:27.345836Z",
          "id": "CVE-2026-43990",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        },
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Dragonmonk111/junoclaw/commit/2bc54f6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-gpvm-3chf-2649",
      "source": "[email protected]"
    }
  ]
}