CVE-2026-16129

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16129

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16129.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16129

Published

2026-07-18T17:00:09.200Z

Modified

2026-07-23T03:56:18.150200425Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

Details

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: "On paper you're correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It's open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users."

Database specific

{
    "isDisputed": true,
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16129.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "last_affected": "4.2.0"
                }
            ]
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-183",
        "CWE-184"
    ]
}

References

Affected packages

Git / github.com/princezuda/safestclaw

Affected ranges

Type

GIT

Repo

https://github.com/princezuda/safestclaw

Events

Introduced

88bc2d1c6246a5ac8eb79f51e51df6f44b56b240

Last affected

2e7578a0c235e3e197c973ac0a164faf720bce01

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "4.2.1"
        },
        {
            "last_affected": "4.2.1"
        },
        {
            "introduced": "4.2.2"
        },
        {
            "last_affected": "4.2.2"
        },
        {
            "introduced": "4.2.3"
        },
        {
            "last_affected": "4.2.3"
        },
        {
            "introduced": "4.2.4"
        },
        {
            "last_affected": "4.2.4"
        }
    ]
}

Affected versions

4.*

4.2.1

4.2.2

4.2.3

4.2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16129.json"