PT-2026-61038 · Zevorn · Rt-Claw

Eric-H · CVE-2026-16204 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zevorn rt-claw versions prior to 0.2.1

Description A code injection flaw exists in the Telegram-to-AI Tool Execution Flow component. The issue resides in the tool run script execute() function within the claw/services/tools/script.c file. A remote attacker can manipulate the system to inject and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the tool run script execute() function to minimize the risk of exploitation.

Exploit

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-16204

Affected Products

Rt-Claw

References · 8

• 🔥 https://github.com/zevorn/rt-claw/issues/138 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16204 · Security Note
• https://twitter.com/VulmonFeeds/status/2078689657697550441 · Twitter Post
• https://vuldb.com/submit/857784 · Note
• https://github.com/zevorn/rt-claw · Note
• https://vuldb.com/vuln/380020 · Note
• https://vuldb.com/cve/CVE-2026-16204 · Note
• https://vuldb.com/vuln/380020/cti · Note