CVE-2026-9565 Overview
CVE-2026-9565 is an OS command injection vulnerability in haojing8312 WorkClaw through version 0.6.4. The flaw resides in the is_dangerous function within apps/runtime/src-tauri/src/agent/tools/bash.rs, part of the Blacklist Handler component. An attacker can manipulate input to bypass the blacklist check and execute arbitrary operating system commands. The issue is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). A public exploit disclosure exists, and the maintainer has not responded to the upstream issue report at the time of publication.
Critical Impact
Authenticated remote attackers can bypass the WorkClaw command blacklist and execute arbitrary OS commands through the agent bash tool.
Affected Products
- haojing8312 WorkClaw versions up to and including 0.6.4
- Component: apps/runtime/src-tauri/src/agent/tools/bash.rs
- Affected function: is_dangerous (Blacklist Handler)
Discovery Timeline
- 2026-05-26 - CVE-2026-9565 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9565
Vulnerability Analysis
WorkClaw is a Tauri-based application that exposes an agent bash tool capable of running shell commands. The is_dangerous function in bash.rs implements a blacklist-style filter intended to reject hazardous commands before invocation. Blacklist-based command filtering is a known-weak control because attackers can use equivalent syntax, alternate binaries, command chaining, environment variable expansion, or quoting tricks to express the same operation in a form the blacklist does not match.
Once the filter is bypassed, the supplied string is handed to the underlying shell executor, allowing arbitrary process execution with the privileges of the WorkClaw runtime. According to the CVSS 4.0 vector, the attack is network-reachable and requires low-level privileges but no user interaction. Impact on confidentiality, integrity, and availability is constrained to the local system scope. The EPSS probability is 0.856%, placing exploitation likelihood in the 75th percentile.
Root Cause
The root cause is reliance on a denylist of dangerous tokens in is_dangerous rather than an allowlist of approved commands and arguments. The function inspects the raw command string for known-bad patterns but does not canonicalize input, parse the shell grammar, or constrain execution to a vetted set of binaries. Any payload that the blacklist fails to enumerate flows directly to the OS shell.
Attack Vector
An authenticated user interacting with the WorkClaw agent submits a crafted command to the bash tool. The string is shaped to avoid blacklisted substrings while still resolving to the desired malicious operation when executed by the shell. The is_dangerous check returns false, the command reaches the executor, and arbitrary OS commands run on the host. Public proof-of-concept material is referenced in the GitHub issue discussion and the VulDB entry #365627. No verified exploit code is reproduced here.
Detection Methods for CVE-2026-9565
Indicators of Compromise
- Unexpected child processes spawned by the WorkClaw src-tauri runtime binary, particularly shells such as sh, bash, cmd.exe, or powershell.exe.
- Agent tool invocations containing obfuscation tokens such as backticks, $(), ${IFS}, \, or piped chains that resolve to sensitive binaries.
- Outbound network connections from the WorkClaw process to non-application destinations following a bash tool invocation.
Detection Strategies
- Audit WorkClaw agent logs for invocations of the bash tool and correlate the submitted command string with the spawned process tree.
- Apply EDR process-lineage rules that flag the WorkClaw runtime as a parent of interactive shells or reconnaissance utilities like whoami, id, curl, or wget.
- Hash and monitor apps/runtime/src-tauri/src/agent/tools/bash.rs and built binaries to detect downgrade or tampering of the blacklist logic.
Monitoring Recommendations
- Forward host process telemetry and WorkClaw application logs to a centralized analytics pipeline for correlation against known command-injection patterns.
- Alert on first-seen command strings submitted to the agent bash tool per user, especially those containing shell metacharacters.
- Track upstream activity on the WorkClaw repository for an official maintainer response or patch commit.
How to Mitigate CVE-2026-9565
Immediate Actions Required
- Restrict access to WorkClaw instances to trusted users only and disable the agent bash tool where it is not required.
- Run the WorkClaw runtime under a least-privileged local account with no administrative rights and no access to sensitive credentials.
- Place the host behind network segmentation so the WorkClaw service is not reachable from untrusted networks.
Patch Information
No official patch is available at the time of publication. The maintainer has been notified via the upstream issue but has not responded. Track the WorkClaw GitHub repository and the VulDB advisory for fix releases beyond version 0.6.4.
Workarounds
- Replace the blacklist in is_dangerous with an allowlist of vetted commands and arguments, or remove the bash tool from the agent toolset entirely.
- Execute the WorkClaw runtime inside a sandbox or container with read-only filesystem mounts, dropped capabilities, and egress filtering.
- Apply OS-level execution controls such as AppArmor, SELinux, or Windows Defender Application Control to constrain which binaries the WorkClaw process can spawn.
# Example: run WorkClaw under a restricted systemd unit
# /etc/systemd/system/workclaw.service
[Service]
User=workclaw
Group=workclaw
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
CapabilityBoundingSet=
RestrictNamespaces=true
SystemCallFilter=@system-service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
