CVE-2026-16129 Overview
CVE-2026-16129 is an incomplete blacklist vulnerability [CWE-183] in princezuda SafestClaw versions up to 4.2.4. The flaw resides in the ShellAction._validate_command function within src/safestclaw/actions/shell.py, part of the Built-in Web Interface component. An attacker with local access and low privileges can manipulate command input to bypass the blacklist filter. The exploit details have been disclosed publicly. The project maintainer has questioned the practical exploitability, noting that the open-source shell allow list can be modified or removed by any user.
Critical Impact
Local low-privileged users may bypass the shell command blacklist in SafestClaw ≤4.2.4, resulting in limited confidentiality, integrity, and availability impact.
Affected Products
- princezuda SafestClaw versions up to and including 4.2.4
- Component: Built-in Web Interface
- Affected function: ShellAction._validate_command in src/safestclaw/actions/shell.py
Discovery Timeline
- 2026-07-18 - CVE-2026-16129 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16129
Vulnerability Analysis
The vulnerability is classified as an incomplete blacklist weakness [CWE-183]. The ShellAction._validate_command function relies on a denylist to filter dangerous shell commands before execution. Because the denylist does not enumerate every dangerous command or syntactic variant, attackers can craft input that avoids listed patterns while still invoking restricted behavior. Incomplete blacklists are a recurring anti-pattern in command validation. Allowlists paired with strict argument parsing generally provide stronger guarantees than denylists.
Root Cause
The root cause is reliance on a denylist within _validate_command that fails to cover all dangerous inputs. The validation logic inspects submitted commands against a finite set of forbidden strings. Commands using alternate encodings, synonymous binaries, chained operators, or shell metacharacters not present in the list pass validation. The maintainer has stated that because the project is open source, the shell allow list is user-modifiable, disputing the practical impact.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An authenticated user of the Built-in Web Interface submits a crafted command through the shell action endpoint. The command evades the blacklist check in _validate_command and reaches the execution path. The impact scope is limited to the local system, and the technical impact on confidentiality, integrity, and availability is low.
No verified proof-of-concept code has been published. Refer to the GitHub Issue Discussion and the VulDB CVE Report for further technical context.
Detection Methods for CVE-2026-16129
Indicators of Compromise
- Unexpected process execution spawned by the SafestClaw shell action worker on hosts running versions ≤4.2.4
- Web interface audit log entries showing shell commands containing metacharacters, chained operators, or encodings not on the maintained denylist
- Local user sessions submitting repeated malformed or obfuscated shell commands to the Built-in Web Interface
Detection Strategies
- Enable verbose logging within ShellAction._validate_command to capture every command string reaching the validator, including those accepted by the denylist
- Alert on child processes of the SafestClaw runtime that fall outside an approved binary list
- Compare shipped denylist contents against runtime configuration to detect tampering with the allow or deny lists
Monitoring Recommendations
- Correlate SafestClaw web interface access logs with local process creation events on the same host
- Track invocations of shell utilities such as sh, bash, python, perl, and busybox spawned from the SafestClaw process tree
- Review file integrity of src/safestclaw/actions/shell.py to detect unauthorized modification of validation logic
How to Mitigate CVE-2026-16129
Immediate Actions Required
- Restrict local access to systems running SafestClaw ≤4.2.4 to trusted users only
- Disable or firewall the Built-in Web Interface where the shell action is not required for operation
- Review and manually harden the shell command denylist in src/safestclaw/actions/shell.py to cover additional dangerous patterns
Patch Information
No vendor patch has been published in the NVD data at the time of writing. Monitor the princezuda SafestClaw repository and the referenced GitHub Issue Discussion for remediation updates. Consider replacing the denylist with an explicit allowlist of permitted binaries and arguments as a durable fix.
Workarounds
- Replace the denylist approach in _validate_command with a strict allowlist that enumerates permitted commands and arguments
- Run SafestClaw under a dedicated low-privilege service account with noexec mounts where feasible to limit the reach of bypassed commands
- Remove or restrict the shell action feature entirely when workflows do not require arbitrary command execution
# Configuration example: run SafestClaw under an unprivileged account
# and bind the web interface to loopback only
sudo useradd --system --shell /usr/sbin/nologin safestclaw
sudo -u safestclaw safestclaw --bind 127.0.0.1 --port 8080 --disable-shell-action
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
