CVE-2026-9453
HighCVSS 7.3Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 contains a command injection vulnerability in the SkillsLoader component. Manipulating the requires.bins argument in /src/application/skills-loader.ts allows remote code execution. The exploit is publicly available. The product does not use versioning, and the project has not responded to the issue report.
Risk Assessment
A remote attacker can execute arbitrary commands on the server, potentially leading to full control of the application and data. The public exploit increases the risk of immediate attack.
Recommendation
Immediately isolate the system from the network or apply temporary mitigations (e.g., firewall blocking access to the vulnerable endpoint). Monitor the project repository for patches.
Other vulnerabilities in FoundDream miniclawd
Original NVD description (English source)
A vulnerability was detected in FoundDream miniclawd up to 2d65665046e2222eeea76cafc8570ed546a8c125. This affects the function which of the file /src/application/skills-loader.ts of the component SkillsLoader. Performing a manipulation of the argument requires.bins results in command injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.