Vulnerabilidades de Dragonmonk111
CVEs publicadas que afetam produtos de Dragonmonk111: 5 registro(s), com severidade, exploração e correções.
CVE-2026-43993
Alta · 8.2
CWE-918 12/05/2026
JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-43992
Crítica · 9.8
CWE-200 12/05/2026
JunoClaw ferramentas de escrita MCP: mnemônico BIP-39 bruto exposto como parâmetro de chamada de ferramenta
O JunoClaw é uma plataforma de IA agêntica construída sobre a Juno Network. Antes de 0.x.y-security-1, toda ferramenta MCP de escrita (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) aceitava 'mnemonic: string' como parâmetro explícito de chamada de ferramenta. Como resultado, a semente BIP-39 ficava incorporada no JSON de chamada de ferramenta do LLM, expondo-a a qualquer transporte, log ou superfície de telemetria no caminho entre o provedor do LLM e o processo MCP. Esta vulnerabilidade está corrigida em 0.x.y-security-1.
CVE-2026-43991
Alta · 8.4
CWE-78 12/05/2026
JunoClaw: plugin-shell shell-injection bypass via substring blocklist
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host when combined with the companion advisory. Pre-patch, the check was applied to the raw command string rather than the parsed first token. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-43990
Alta · 8.4
CWE-77 12/05/2026
JunoClaw: plugin-shell shell-metacharacter injection via shell wrapper
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-43989
Alta · 8.5
CWE-20 12/05/2026
JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.