Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-18980: nearai ironclaw allows remote command injection

CVE-2026-18980 · published 3 months ago

Summary

The ironclaw software version 0.29.1 or earlier can be tricked into running unauthorized commands through a specific feature. This could let an attacker control the system from outside the network. Install the provided update to close the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
nearai	ironclaw	0.29.0

Original advisory text

nearai ironclaw shell.rs classify_command_risk command injection

A vulnerability was identified in nearai ironclaw up to 0.29.1. Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is a1d7c3ba428ed575900469b207fb5668725f9a71. Applying a patch is advised to resolve this issue.

References

https://vuldb.com/cve/CVE-2026-18980 Vendor Advisory
https://vuldb.com/vuln/386265 Vendor Advisory
https://vuldb.com/vuln/386265/cti Third Party Advisory
https://vuldb.com/submit/862542 Vendor Advisory
https://vuldb.com/submit/862543 Vendor Advisory
https://vuldb.com/submit/862544 Vendor Advisory
https://vuldb.com/submit/862545 Vendor Advisory
https://github.com/nearai/ironclaw/ URL
https://github.com/nearai/ironclaw/issues/4861 Third Party Advisory
https://github.com/nearai/ironclaw/issues/4862 Third Party Advisory
https://github.com/nearai/ironclaw/commit/a1d7c3ba428ed575900469b207fb5668725f9a... Patch
https://github.com/nearai/ironclaw/pull/4869 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18980... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18980 Vendor Advisory
https://vuldb.com/submit/862546 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

2% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-74Injection

Timeline

Published6 Aug 2026

Updated4 Nov 2026

First seen6 Aug 2026

Sources

CVE-2026-18980 · NVD

CVE-2026-18980 · MITRE

CVE-2026-18980 · OSV

Track software like this

Free during beta