PT-2026-39463 · Miniclaw · Miniclaw

Ybdesire · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-8235

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 8421bit MiniClaw versions 0.8.0 through 0.9.0

Description An OS command injection issue exists within the System Command Handler component. The flaw is located in the resolveSkillScriptPath() function of the src/kernel.ts file, where improper manipulation allows for the execution of arbitrary operating system commands.

Recommendations Apply patch 223c16a1088e138838dcbd18cd65a37c35ac5a84 for versions 0.8.0 through 0.9.0. As a temporary workaround, restrict access to the resolveSkillScriptPath() function to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-8235

Affected Products

Miniclaw

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8235.json · Exploit
• 🔥 https://github.com/8421bit/MiniClaw/issues/6 · Exploit
• 🔥 https://github.com/8421bit/MiniClaw/issues/6#issue-4290453729 · Exploit
• https://github.com/8421bit/MiniClaw/commit/223c16a1088e138838dcbd18cd65a37c35ac5a84 · Patch
• https://github.com/8421bit/MiniClaw/pull/7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8235 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8235 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053537475637948632 · Twitter Post
• https://vuldb.com/vuln/362455/cti · Note
• https://t.me/cveNotify/162921 · Telegram Post
• https://github.com/8421bit/MiniClaw · Note
• https://t.me/CVEtracker/53289 · Telegram Post
• https://vuldb.com/vuln/362455 · Note
• https://vuldb.com/submit/809001 · Note
• https://twitter.com/VulmonFeeds/status/2053421265797406940 · Twitter Post