CVE-2026-16204: zevorn rt-claw RCE Vulnerability

CVE-2026-16204 Overview

CVE-2026-16204 is a code injection vulnerability [CWE-74] in the zevorn rt-claw project through version 0.2.0. The flaw resides in the tool_run_script_execute function within claw/services/tools/script.c, part of the Telegram-to-AI Tool Execution Flow component. An attacker can manipulate input passed to this function to inject and execute arbitrary code remotely. A public exploit has been released, and the project maintainers have not responded to the disclosure issue filed against the repository.

Critical Impact
Remote attackers can inject code into the script execution tool exposed through the Telegram-to-AI integration, resulting in low-impact compromise of confidentiality, integrity, and availability on affected rt-claw deployments.

Affected Products

zevorn rt-claw versions up to and including 0.2.0
claw/services/tools/script.c component
Telegram-to-AI Tool Execution Flow

Discovery Timeline

2026-07-19 - CVE-2026-16204 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-16204

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). It affects the tool_run_script_execute function in claw/services/tools/script.c, which processes script content routed through the Telegram-to-AI tool execution pipeline. Because inputs are passed to the script execution routine without adequate neutralization, an attacker who controls the tool invocation payload can inject syntax that alters the intended script behavior. The attack originates over the network and requires user interaction to trigger the tool execution path.

Root Cause

The root cause is missing or insufficient input neutralization in tool_run_script_execute. The function accepts data originating from the AI tool-calling interface and forwards it into script execution logic without sanitizing control characters or command delimiters. This allows crafted input to break out of the intended script context.

Attack Vector

An attacker interacts with the Telegram bot front-end that drives the rt-claw AI tool execution flow. By crafting a message or tool argument that manipulates the parameters reaching tool_run_script_execute, the attacker triggers execution of injected code within the host process running rt-claw. A public proof-of-concept is available via the project's issue tracker.

The vulnerability manifests when unsanitized input from the AI tool-calling layer reaches the script execution primitive. See the GitHub Issue #138 and VulDB entry for CVE-2026-16204 for technical details and reproduction steps.

Detection Methods for CVE-2026-16204

Indicators of Compromise

Unexpected child processes spawned by the rt-claw binary or its script execution helper.
Telegram bot messages containing shell metacharacters, command separators, or scripting syntax directed at tool invocations.
Outbound network connections initiated by rt-claw shortly after receiving a Telegram tool-execution request.

Detection Strategies

Monitor process lineage from rt-claw for spawning of shells or interpreters not part of legitimate operation.
Inspect application logs for tool invocations targeting tool_run_script_execute with suspicious argument payloads.
Deploy runtime behavioral monitoring on hosts running rt-claw to flag anomalous script execution originating from AI tool flows.

Monitoring Recommendations

Enable verbose logging of Telegram-to-AI tool invocations and store logs centrally for correlation.
Alert on any modification of claw/services/tools/script.c or the compiled rt-claw binary in production.
Track EPSS scoring updates and public exploit chatter referencing VulDB #380020.

How to Mitigate CVE-2026-16204

Immediate Actions Required

Take rt-claw instances offline or restrict Telegram bot access to trusted users only until a fix is available.
Audit any historical Telegram tool execution logs for evidence of exploitation.
Run rt-claw under a low-privilege, sandboxed user account to limit blast radius.

Patch Information

At the time of publication, no vendor patch is available. The project was notified through GitHub Issue #138 but has not responded. Monitor the rt-claw repository for future releases.

Workarounds

Disable the script execution tool in the AI tool registry so tool_run_script_execute cannot be invoked.
Restrict the Telegram bot to an allowlist of trusted user IDs via bot configuration.
Run rt-claw inside a container or chroot with no shell access and read-only filesystem where possible.
Add an input filter in front of the AI tool dispatcher to reject payloads containing shell metacharacters.

bash

# Example: restrict rt-claw service with systemd sandboxing
[Service]
ExecStart=/usr/local/bin/rt-claw
User=rtclaw
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
RestrictSUIDSGID=true
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM