CVE-2026-18980 | nearai ironclaw up to 0.29.1 shell.rs classify_command_risk command injection (4861/4862/4863/4864/4865 / CNNVD-2026-74300350)

A vulnerability was found in . Affected is the function classify_command_risk of the file src/tools/builtin/shell.rs. Such manipulation leads to command injection.

This vulnerability is traded as CVE-2026-18980. The attack may be launched remotely. Furthermore, there is an exploit available.

Applying a patch is advised to resolve this issue.