CVE-2026-8235
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. The function resolveSkillScriptPath in src/kernel.ts of the System Command Handler component allows OS command injection. The exploit is publicly available.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the server, leading to full system compromise and data loss.
Recommendation
Immediately apply the patch with ID 223c16a1088e138838dcbd18cd65a37c35ac5a84 to eliminate the vulnerability.
Original NVD description (English source)
A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component System Command Handler. The manipulation results in os command injection. The exploit is now public and may be used. The patch is identified as 223c16a1088e138838dcbd18cd65a37c35ac5a84. It is best practice to apply a patch to resolve this issue.