Is there a public PoC exploit available for CVE-2026-8235?

Yes, a public proof-of-concept exploit is available for CVE-2026-8235. Prioritise patching immediately. EPSS: 1.1%.

Is there a patch available for CVE-2026-8235?

Yes, a patch is available for CVE-2026-8235. Update the affected software to the latest version immediately.

8421bit MiniClaw CVE-2026-8235

Q: What is the CVSS score of CVE-2026-8235?

CVE-2026-8235 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-28988 LOW

OS Command Injection (CWE-78)

2026-05-10 VulDB

GHSA-hpxg-grhm-7fxc

Command Injection

2.0

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 10, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 07:22 NVD

5.5 (MEDIUM) 2.0 (LOW)

Source Code Evidence Fetched

May 10, 2026 - 07:15 vuln.today

Analysis Generated

May 10, 2026 - 07:15 vuln.today

CVE Published

May 10, 2026 - 06:15 nvd

MEDIUM 5.5

DescriptionNVD

A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component System Command Handler. The manipulation results in os command injection. The exploit is now public and may be used. The patch is identified as 223c16a1088e138838dcbd18cd65a37c35ac5a84. It is best practice to apply a patch to resolve this issue.

AnalysisAI

OS command injection in 8421bit MiniClaw 0.8.0 and 0.9.0 allows local authenticated attackers to execute arbitrary system commands via the resolveSkillScriptPath function in the System Command Handler (src/kernel.ts). The vulnerability stems from unsafe command construction using string concatenation with unsanitized user input passed to shell execution. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-8235 vulnerability details – vuln.today

Back