A code injection vulnerability (CVE-2026-16204) affects zevorn rt-claw versions 0.1 and 0.2.0 in the tool_run_script_execute function of claw/services/tools/script.c, related to the Telegram-to-AI Tool Execution Flow. This flaw permits remote attackers to manipulate input to execute arbitrary code. The vulnerability was responsibly disclosed but remains unaddressed by the vendor. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability. No patch or official remediation has been released.

Successful exploitation allows remote attackers to perform code injection, potentially leading to arbitrary code execution within the affected application context. This can compromise the integrity and availability of the affected system. The medium severity score reflects moderate impact and exploitability. There is no indication of known exploits in the wild at this time.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, consider restricting network access to the affected service and applying any available application-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.