---
title: "GHSA-5wp8-q9mx-8jx8: zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards"
url: https://erroneo.us/security/ghsa/GHSA-5wp8-q9mx-8jx8/
description: "GHSA-5wp8-q9mx-8jx8 (critical, crates.io (Rust)): zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards.…"
type: advisory
section: "Security Digest"
date_published: 2026-03-05
date_modified: 2026-03-05
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-5wp8-q9mx-8jx8"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-5wp8-q9mx-8jx8: zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards

## Affected packages

- crates.io (Rust) `zeptoclaw` <= 0.6.1 → fixed: 0.6.2

## Details

Summary zeptoclaw implements a allowlist combined with a blocklist to prevent malicious shell commands in src/security/shell.rs. However, even in the Strict mode, attackers can completely bypass all the guards from allowlist and blocklist: - to bypass the allowlist, command injection is enough, such as ;, $() etc. - to bypass the REGEXBLOCKEDPATTERNS, argument injection is enough, such as the python3 -P -c "..." - to bypass the LITERALBLOCKEDPATTERNS, file name wildcards can do the work, such as cat /etc/pass[w]d Details In code src/security/shell.rs#L218-L243, one can see the allowlist only checks the first token and thus makes command injection possible. !self.allowlist.isempty() makes the empty allowlist overlook the allowlist check, if it is in ShellAllowlistMode::Strict mode, empty allowlist should direct reject all the commands. As the code in src/security/shell.rs#L18-L70, we can find the REGEXBLOCKEDPATTERNS only apply \s+ in between the command and arguments, making argument injection possible, and the LITERALBLOCKEDPATTERNS just uses specific file name, totally overlooking the file name wildcards: PoC Impact Unauthorized command execution. Credit @zpbrent

## Sources

- [GitHub Advisory GHSA-5wp8-q9mx-8jx8](https://github.com/advisories/GHSA-5wp8-q9mx-8jx8)
- [github.com](https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-5wp8-q9mx-8jx8)
- [github.com](https://github.com/qhkm/zeptoclaw/commit/68916c3e4f3af107f11940b27854fc7ef517058b)
- [github.com](https://github.com/qhkm/zeptoclaw/blob/fe2ef07cfec5bb46b42cdd65f52b9230c03e9270/src/security/shell.rs#L218-L243)

---
Source page: https://erroneo.us/security/ghsa/GHSA-5wp8-q9mx-8jx8/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt