CVE-2026-15618

mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecCommand of the file tools/tool_exec.go of the component exec Safety Guard. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".

Analysis

AI-generated

Technical impact

The vulnerability resides in the guardExecCommand function found in tools/tool_exec.go, disabling the command execution protection. The description indicates that manipulation results in protection mechanism failure and that it is possible to launch the attack remotely; it is inferred that disabling the execution guard may allow a remote attacker to run arbitrary operating‑system commands. This flaw corresponds to CWE-693 (Security Misconfiguration) and can lead to remote code execution.

Affected Systems

The flaw affects the mosaxiv clawlet package, versions up to and including 0.2.10. No other versions are listed as affected. Users running these versions should consider upgrading once a fix becomes available.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1% and CISA has not listed it in KEV yet. A public exploit has been released, and may be used for attacks. The attack vector is inferred as remote, requiring network access to the component that invokes guardExecCommand. Given the lack of a published patch at this time, the vulnerability remains exploitable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the mosaxiv clawlet package to a version newer than 0.2.10 where the guardExecCommand issue has been addressed.
  • Limit the exposure of the component that calls guardExecCommand by restricting network access to trusted hosts or behind firewalls.
  • Implement input validation and sanitization on any arguments passed to guardExecCommand to prevent arbitrary command injection, following best practices for CWE-693.

Generated by OpenCVE AI on August 1, 2026 at 10:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecCommand of the file tools/tool_exec.go of the component exec Safety Guard. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed with the label "not planned".
Title mosaxiv clawlet exec Safety Guard tool_exec.go guardExecCommand protection mechanism
First Time appeared Mosaxiv
Mosaxiv clawlet
Weaknesses CWE-693
CPEs cpe:2.3:a:mosaxiv:clawlet:*:*:*:*:*:*:*:*
Vendors & Products Mosaxiv
Mosaxiv clawlet
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-693

    Protection Mechanism Failure

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 12:47 PM
Reserved
Jul 13, 2026, 4:57 PM

View source JSON

Updated
Jul 14, 2026, 12:47 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 12:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 10:15 AM

JSON