The vulnerability CVE-2026-43990 affects Dragonmonk111's junoclaw platform versions prior to 0.x.y-security-1. It is a command injection flaw (CWE-77, CWE-78) caused by improper neutralization of special shell elements in agent-supplied commands. The plugin-shell's run_command function executes commands by wrapping them in 'sh -c' or 'cmd /C' and passing the entire argument string to the shell parser, which interprets shell metacharacters. This allows an attacker controlling agent inputs to inject arbitrary shell commands. The vulnerability is resolved in version 0.x.y-security-1. No vendor advisory or patch link is provided, and the product is not a cloud service, so remediation depends on upgrading to the fixed version.

Successful exploitation can lead to arbitrary command execution with the privileges of the junoclaw process, resulting in full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 score of 8.4 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Upgrade junoclaw to version 0.x.y-security-1 or later, where this command injection vulnerability is fixed. Since no official vendor advisory or patch link is provided, rely on the version upgrade as the primary remediation. There is no indication that the vulnerability is mitigated by configuration changes or other temporary fixes.