Home

Description

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-12 | Updated 2026-03-12 | Assigner GitHub_M




HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-62: UNIX Hard Link

Product status

< 0.7.6
affected

References

github.com/...toclaw/security/advisories/GHSA-2m67-cxxq-c3h8

github.com/...ommit/f50c17e11ae3e2d40c96730abac41974ef2ee2a8

cve.org (CVE-2026-32232)

nvd.nist.gov (CVE-2026-32232)

Download JSON