GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

Not scored Published 5 Mar 2026

Attackers can bypass shell command restrictions in zeptoclaw via injection techniques, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-5wp8-q9mx-8jx8?

GHSA-5wp8-q9mx-8jx8 is a command injection vulnerability in zeptoclaw, published on 5 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Summary

zeptoclaw implements a allowlist combined with a blocklist to prevent malicious shell commands in src/security/shell.rs. However, even in the Strict mode, attackers can completely bypass all the guards from allowlist and blocklist:

to bypass the allowlist, command injection is enough, such as ;, $() etc.
to bypass the REGEX_BLOCKED_PATTERNS, argument injection is enough, such as the python3 -P -c "..."
to bypass the LITERAL_BLOCKED_PATTERNS, file name wildcards can do the work, such as cat /etc/pass[w]d

Details

In code src/security/shell.rs#L218-L243, one can see the allowlist only checks the first token and thus makes command injection possible.

        // Allowlist check (runs after blocklist)
        if self.allowlist_mode != ShellAllowlistMode::Off &amp;&amp; !self.allowlist.is_empty() {
            let first_token = command
                .split_whitespace()
                .next()
                .unwrap_or(&#34;&#34;)
                .to_lowercase();
            // Strip path prefix (e.g. /usr/bin/git -&gt; git)
            let executable = first_token.rsplit(&#39;/&#39;).next().unwrap_or(&amp;first_token);
            if !self.allowlist.iter().any(|a| a == executable) {
                match self.allowlist_mode {
                    ShellAllowlistMode::Strict =&gt; {
                        return Err(ZeptoError::SecurityViolation(format!(
                            &#34;Command &#39;{}&#39; not in allowlist&#34;,
                            executable
                        )));
                    }
                    ShellAllowlistMode::Warn =&gt; {
                        tracing::warn!(
                            command = %command,
                            executable = %executable,
                            &#34;Command not in allowlist&#34;
                        );
                    }
                    ShellAllowlistMode::Off =&gt; {} // unreachable
                }

!self.allowlist.is_empty() makes the empty allowlist overlook the allowlist check, if it is in ShellAllowlistMode::Strict mode, empty allowlist should direct reject all the commands.

As the code in src/security/shell.rs#L18-L70, we can find the REGEX_BLOCKED_PATTERNS only apply \s+ in between the command and arguments, making argument injection possible, and the LITERAL_BLOCKED_PATTERNS just uses specific file name, totally overlooking the file name wildcards:

const REGEX_BLOCKED_PATTERNS: &amp;[&amp;str] = &amp;[
    // Piped shell execution (curl/wget to sh/bash)
    r&#34;curl\s+.*\|\s*(sh|bash|zsh)&#34;,
    r&#34;wget\s+.*\|\s*(sh|bash|zsh)&#34;,
    r&#34;\|\s*(sh|bash|zsh)\s*$&#34;,
    // Reverse shells
    r&#34;bash\s+-i\s+&gt;&amp;\s*/dev/tcp&#34;,
    r&#34;nc\s+.*-e\s+(sh|bash|/bin)&#34;,
    r&#34;/dev/tcp/&#34;,
    r&#34;/dev/udp/&#34;,
    // Destructive root operations (various flag orderings)
    r&#34;rm\s+(-[rf]{1,2}\s+)*(-[rf]{1,2}\s+)*/\s*($|;|\||&amp;)&#34;,
    r&#34;rm\s+(-[rf]{1,2}\s+)*(-[rf]{1,2}\s+)*/\*\s*($|;|\||&amp;)&#34;,
    // Format/overwrite disk
    r&#34;mkfs(\.[a-z0-9]+)?\s&#34;,
    r&#34;dd\s+.*if=/dev/(zero|random|urandom).*of=/dev/[sh]d&#34;,
    r&#34;&gt;\s*/dev/[sh]d[a-z]&#34;,
    // System-wide permission changes
    r&#34;chmod\s+(-R\s+)?777\s+/\s*$&#34;,
    r&#34;chmod\s+(-R\s+)?777\s+/[a-z]&#34;,
    // Fork bombs
    r&#34;:\(\)\s*\{\s*:\|:&amp;\s*\}\s*;:&#34;,
    r&#34;fork\s*\(\s*\)&#34;,
    // Encoded/indirect execution (common blocklist bypasses)
    r&#34;base64\s+(-d|--decode)&#34;,
    r&#34;python[23]?\s+-c\s+&#34;,
    r&#34;perl\s+-e\s+&#34;,
    r&#34;ruby\s+-e\s+&#34;,
    r&#34;node\s+-e\s+&#34;,
    r&#34;\beval\s+&#34;,
    r&#34;xargs\s+.*sh\b&#34;,
    r&#34;xargs\s+.*bash\b&#34;,
    // Environment variable exfiltration
    r&#34;\benv\b.*&gt;\s*/&#34;,
    r&#34;\bprintenv\b.*&gt;\s*/&#34;,
];

/// Literal substring patterns (credentials, sensitive paths)
const LITERAL_BLOCKED_PATTERNS: &amp;[&amp;str] = &amp;[
    &#34;/etc/shadow&#34;,
    &#34;/etc/passwd&#34;,
    &#34;~/.ssh/&#34;,
    &#34;.ssh/id_rsa&#34;,
    &#34;.ssh/id_ed25519&#34;,
    &#34;.ssh/id_ecdsa&#34;,
    &#34;.ssh/id_dsa&#34;,
    &#34;.ssh/authorized_keys&#34;,
    &#34;.aws/credentials&#34;,
    &#34;.kube/config&#34;,
    // ZeptoClaw&#39;s own config (contains API keys and channel tokens)
    &#34;.zeptoclaw/config.json&#34;,
    &#34;.zeptoclaw/config.yaml&#34;,
];

PoC

    #[test]
    fn test_allowlist_bypass() {
        let config =
            ShellSecurityConfig::new().with_allowlist(vec![&#34;git&#34;], ShellAllowlistMode::Strict);
        assert!(config.validate_command(&#34;/usr/bin/git status; python -P -c &#39;import os; os.system(\&#34;rm -rf /\&#34;)&#39;; cat /etc/pass[w]d&#34;).is_ok());
    }

Impact

Unauthorized command execution.

Credit

@zpbrent

Which versions are affected by GHSA-5wp8-q9mx-8jx8?

2 open source packages ship an affected version, including zeptoclaw.

Package	Affected	Fixed in
`zeptoclaw` crates.io	All versions	`0.6.2`
`zeptoclaw` crates.io	All versions	`0.6.2`

How do I fix GHSA-5wp8-q9mx-8jx8?

Upgrade zeptoclaw to 0.6.2 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is GHSA-5wp8-q9mx-8jx8 being exploited?

There is no known exploitation of GHSA-5wp8-q9mx-8jx8 in the wild and no public exploit code.