Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by princezuda
CVE-2026-16129 (GCVE-0-2026-16129)
Vulnerability from nvd – Published: 2026-07-18 17:00 – Updated: 2026-07-18 17:00 Disputed
VLAI
EPSS
VEX
Title
princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist
Summary
A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: "On paper you're correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It's open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users."
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379845 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379845/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16129 | third-party-advisory |
| https://vuldb.com/submit/856882 | third-party-advisory |
| https://github.com/princezuda/safestclaw/issues/59 | exploitissue-tracking |
| https://github.com/princezuda/safestclaw/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| princezuda | SafestClaw |
Affected:
4.2.0
Affected: 4.2.1 Affected: 4.2.2 Affected: 4.2.3 Affected: 4.2.4 cpe:2.3:a:princezuda:safestclaw:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:princezuda:safestclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"Built-in Web Interface"
],
"product": "SafestClaw",
"vendor": "princezuda",
"versions": [
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "4.2.1"
},
{
"status": "affected",
"version": "4.2.2"
},
{
"status": "affected",
"version": "4.2.3"
},
{
"status": "affected",
"version": "4.2.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-x (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: \"On paper you\u0027re correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It\u0027s open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "Incomplete Blacklist",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-183",
"description": "Permissive List of Allowed Inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T17:00:09.200Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379845 | princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379845"
},
{
"name": "VDB-379845 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379845/cti"
},
{
"name": "CVE-2026-16129 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16129"
},
{
"name": "Submit #856882 | princezuda safestclaw 4.2.4 Incomplete List of Disallowed Inputs (CWE-184)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856882"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/princezuda/safestclaw/issues/59"
},
{
"tags": [
"product"
],
"url": "https://github.com/princezuda/safestclaw/"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:18:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16129",
"datePublished": "2026-07-18T17:00:09.200Z",
"dateReserved": "2026-07-17T16:13:27.659Z",
"dateUpdated": "2026-07-18T17:00:09.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16129 (GCVE-0-2026-16129)
Vulnerability from cvelistv5 – Published: 2026-07-18 17:00 – Updated: 2026-07-18 17:00 Disputed
VLAI
EPSS
VEX
Title
princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist
Summary
A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: "On paper you're correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It's open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users."
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/379845 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/379845/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-16129 | third-party-advisory |
| https://vuldb.com/submit/856882 | third-party-advisory |
| https://github.com/princezuda/safestclaw/issues/59 | exploitissue-tracking |
| https://github.com/princezuda/safestclaw/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| princezuda | SafestClaw |
Affected:
4.2.0
Affected: 4.2.1 Affected: 4.2.2 Affected: 4.2.3 Affected: 4.2.4 cpe:2.3:a:princezuda:safestclaw:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:princezuda:safestclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"Built-in Web Interface"
],
"product": "SafestClaw",
"vendor": "princezuda",
"versions": [
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "4.2.1"
},
{
"status": "affected",
"version": "4.2.2"
},
{
"status": "affected",
"version": "4.2.3"
},
{
"status": "affected",
"version": "4.2.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-x (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The project maintainer explains: \"On paper you\u0027re correct, this is a vulnerability. In practice, nothing your AI generated shows how it makes users vulnerable. It\u0027s open source. Someone can mod the shell allow list or remove that system. Present an actual poc that shows a threat to users.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-184",
"description": "Incomplete Blacklist",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-183",
"description": "Permissive List of Allowed Inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T17:00:09.200Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-379845 | princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/379845"
},
{
"name": "VDB-379845 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/379845/cti"
},
{
"name": "CVE-2026-16129 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-16129"
},
{
"name": "Submit #856882 | princezuda safestclaw 4.2.4 Incomplete List of Disallowed Inputs (CWE-184)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/856882"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/princezuda/safestclaw/issues/59"
},
{
"tags": [
"product"
],
"url": "https://github.com/princezuda/safestclaw/"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-17T18:18:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-16129",
"datePublished": "2026-07-18T17:00:09.200Z",
"dateReserved": "2026-07-17T16:13:27.659Z",
"dateUpdated": "2026-07-18T17:00:09.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}