The flaw resides in the ExecApprovalManager.CheckCommand function of GoClaw, where the command blacklist is not fully enforced. This omission allows an attacker to craft input that bypasses the check and invokes arbitrary commands on the host. The vulnerability is a blacklisting bypass leading to the execution of commands supplied by an external source. The failure to validate user input against the command blacklist is a textbook example of CWE-183 (Unvalidated Input for Authorization) and CWE-184 (Unvalidated Input for Control Flow).

The issue targets the GoClaw tool from nextlevelbuilder, specifically version 3.11.3. No other releases are identified in the data, so the impact is confined to systems running this exact build.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% shows only a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. However, the publicly available exploit and the fact that the issue can be triggered by remote input make the flaw feasible for attackers who can reach the affected component. The root weakness is a blacklist bypass recognized as CWE-183 and CWE-184.