miniclawd EUVD-2026-31668

No special conditions are required for exploitation - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation against the miniclawd service with no complexity barrier and no required user interaction. The limiting factors are: (1) the miniclawd service must be network-accessible to the attacker, as it is not exploitable if firewalled from untrusted networks; (2) the ExecTool.execute code path must be reachable in the deployed configuration - if the tool-execution feature is disabled or gated, exploitation is prevented; and (3) the CVSS impact scores (VC:L/VI:L/VA:L) suggest potential runtime constraints such as process sandboxing or limited shell access that may restrict post-exploitation capability. No authentication, specific OS, or non-default configuration is required for initial exploitation.

The CVSS 4.0 base score of 5.5 (Medium) reflects limited but confirmed impact across confidentiality, integrity, and availability (all rated Low), with no scope change to downstream systems (SC:N/SI:N/SA:N). Despite the moderate numeric score, the risk profile is elevated by several converging signals: the attack vector is fully remote (AV:N) with no authentication required (PR:N), no complexity barrier (AC:L), and the E:P modifier in the CVSS 4.0 vector explicitly encodes proof-of-concept exploit availability. The EPSS score of 1.04% at the 78th percentile indicates that while absolute exploitation probability is low, this CVE ranks higher than 78% of all scored vulnerabilities - a meaningful signal for a relatively obscure open-source tool. No CISA KEV listing exists, so widespread active exploitation is not confirmed. The most significant risk amplifier is the unpatched state: the vendor has not responded to disclosure, leaving defenders with no official remediation path. The CVSS impact scores being uniformly 'Low' rather than 'High' may reflect partial command execution constraints or sandboxing in the tool's runtime context - this should be verified against actual deployment architecture.

An unauthenticated remote attacker sends a crafted HTTP request (or equivalent network payload) to the miniclawd service containing shell metacharacters - such as semicolons, backticks, or pipe operators - embedded in input fields processed by ExecTool.execute in exec.ts. The unsanitized input is passed directly to a system shell call, causing the injected commands to execute with the privileges of the miniclawd process. A publicly available proof-of-concept demonstrating this technique was disclosed via the project's GitHub issue tracker, lowering the barrier for exploitation by less sophisticated attackers.