zeptoclaw vulnerabilities

2 known vulnerabilities in zeptoclaw from Qhkm. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  zeptoclaw: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-32232Mar 12, 2026Qhkm

  ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.

• 8.2 High severity

  zeptoclaw: Missing Authentication for Critical Functionality

  CVE-2026-32231Mar 12, 2026Qhkm

  ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and