EUVD-2026-31671
GHSA-cjqg-8xv4-hwwm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. This affects the function which of the file /src/application/skills-loader.ts of the component SkillsLoader. Performing a manipulation of the argument requires.bins results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Command injection in FoundDream miniclawd's SkillsLoader component exposes systems to remote unauthenticated arbitrary command execution via unsanitized manipulation of the requires.bins argument in /src/application/skills-loader.ts. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and SSVC classifies the attack as automatable with partial technical impact. A public exploit (POC) exists via GitHub issue tracker, the vendor has not responded to disclosure, and no patch has been released - leaving affected deployments with no official remediation path.
Technical ContextAI
miniclawd is a TypeScript-based application by FoundDream that implements a SkillsLoader component responsible for loading skills and resolving binary dependencies. The vulnerable which function in /src/application/skills-loader.ts accepts a requires.bins argument - likely a list of binary names to locate on the host system - and passes this value unsanitized into a shell command execution context. CWE-77 (Improper Neutralization of Special Elements used in a Command) is the root cause class: attacker-controlled input containing shell metacharacters (e.g., semicolons, backticks, pipes) is interpreted by the underlying shell rather than treated as a literal string. The CPE cpe:2.3:a:founddream:miniclawd:*:*:*:*:*:*:*:* with a wildcard version indicates all tracked releases are affected up through commit 2d65665046e2222eeea76cafc8570ed546a8c125.
RemediationAI
No vendor-released patch identified at time of analysis. The FoundDream project was notified via issue report but has not responded, and no remediated commit or release is available. Organizations running miniclawd should treat this as an unpatched vulnerability with a public exploit. Specific compensating controls in priority order: First, restrict network access to miniclawd instances using firewall rules or network segmentation - limit exposure to trusted internal hosts only, accepting the trade-off of reduced accessibility. Second, if the SkillsLoader component or binary resolution feature is not required for your use case, disable or remove the /src/application/skills-loader.ts module from deployment, noting this may break skill-loading functionality. Third, implement input validation at the application boundary to strip or reject shell metacharacters (;, |, ` `, $(), &&, ||) from any requires.bins values before they reach the which` function - this requires a code-level change and carries risk of breaking legitimate binary names if over-aggressively filtered. Monitor the GitHub repository at https://github.com/FoundDream/miniclawd/ and issue tracker for any vendor response or upstream patch.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today