Command Injection Vulnerability in JunoClaw AI Platform

CVE-2026-43990

What is CVE-2026-43990?

The JunoClaw AI platform, developed by Juno Network, has a command injection vulnerability in its plugin-shell component prior to version 0.x.y-security-1. The issue arises from the way agent-supplied commands are processed, where commands are wrapped in 'sh -c' or 'cmd /C', allowing shell metacharacters to be interpreted as command syntax. This could lead to unauthorized command execution, compromising the security of affected systems. The vulnerability was addressed in version 0.x.y-security-1. Users are advised to update promptly to mitigate risks.

References