qhkm/zeptoclaw Security Advisories | GitStock

medium2026-03-12

ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation

GHSA-4cm8-xpfv-jv6f

high2026-03-12

ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink

GHSA-2m67-cxxq-c3h8 · CVE-2026-32232

high2026-03-12

ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

GHSA-46q5-g3j9-wx5c · CVE-2026-32231

critical2026-03-05

zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

GHSA-5wp8-q9mx-8jx8

high2026-03-05

zeptoclaw has Android device shell blocklist bypass via argument permutation

GHSA-hhjv-jq77-cmvx