CVE-2026-9452

HighCVSS 7.3

Published: 25/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.39%

69th percentile - higher than 69% of all known CVEs

Summary

FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 contains an OS command injection vulnerability in the ExecTool.execute function in /src/tools/exec.ts. The attack can be launched remotely. The exploit is publicly available. The product does not use versioning, and the project has not responded to the issue.

Risk Assessment

A remote attacker can execute arbitrary system commands, leading to full server compromise. The public exploit increases the urgency of applying security updates.

Recommendation

Immediately isolate the system from the network or apply temporary mitigations (e.g., firewall blocking access to the vulnerable endpoint). Monitor the project repository for patches.

Other vulnerabilities in FoundDream miniclawd

CVE-2026-9453High
FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 contains a command injection vulnerability in the SkillsLoader component. Manipulating the requires.bins argument in /src/application/skills-loader.ts allows remote code execution. The exploit is publicly available. The product does not use versioning, and the project has not responded to the issue report.

Original NVD description (English source)

A security vulnerability has been detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. Affected by this issue is the function ExecTool.execute of the file /src/tools/exec.ts. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.