CVE-2026-16204 zevorn CVE debrief

Who should care

Users of zevorn rt-claw up to version 0.2.0 should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Affected operator, platform, vulnerability-management, and security-team impact should be considered.

Technical summary

The vulnerability is caused by a flaw in the tool_run_script_execute function of the claw/services/tools/script.c file. This function is part of the Telegram-to-AI Tool Execution Flow. The flaw allows for code injection, which can be exploited remotely. The CVSS score for this vulnerability is 2.1, indicating a low severity. The project was informed of the problem early through an issue report but has not responded yet. The source details are limited, and defenders should verify the affected scope and severity with the vendor.

Defensive priority

Low

Recommended defensive actions

• Inventory and verify the version of zevorn rt-claw in use
• Apply patches or updates as available from the vendor
• Monitor for suspicious activity related to the Telegram-to-AI Tool Execution Flow
• Consider implementing compensating controls to prevent exploitation
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-19T03:16:42.087Z and has not been modified since then. The NVD entry is currently Received. The project was informed of the problem early through an issue report but has not responded yet. The source details are limited, and defenders should verify the affected scope and severity with the vendor. The vulnerability affects zevorn rt-claw up to version 0.2.0. Additional verification tasks are required to confirm the affected scope and severity.

Official resources