Dragonmonk111 vulnerabilities
We track 5 vulnerabilities in Dragonmonk111 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 12, 2026.
Latest Dragonmonk111 vulnerabilities
- 8.2 High severity
junoclaw: Server-Side Request Forgery
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerabili
- 9.8 Critical severity
junoclaw: Exposure of Sensitive Information to an Unauthorized Actor
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The
- 8.4 High severity
junoclaw: Improper Neutralization of Special Elements used in an OS Command
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by adversarial argument constructions, allowing unauthorized command execution on the host w
- 8.4 High severity
junoclaw: Improper Neutralization of Special Elements used in a Command
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters
- 8.5 High severity
JunoClaw is an agentic AI platform built on Juno Network.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size,