Medium 5.5Published May 10, 2026

CVE-2026-82358421bit MiniClaw System kernel.ts resolveSkillScriptPath os command injection

Updated under an hour ago (Oct 26, 2026, 1:30 PM ET)

Does this affect you?

It affects 8421bit MiniClaw. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for 8421bit MiniClaw

Exploited in the last 30 days

A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component System Command Handler. The manipulation results in os command injection. The exploit is now public and may be used. The patch is identified as 223c16a1088e138838dcbd18cd65a37c35ac5a84. It is best practice to apply a patch to resolve this issue.

CVSS: 5.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-78, CWE-77
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

8421bit MiniClaw 8421bit:miniclaw (from the name)	0.8.0; 0.9.0	CNA record

References

References

https://vuldb.com/vuln/362455	vdb-entry, technical-description
https://vuldb.com/vuln/362455/cti	signature, permissions-required
https://vuldb.com/submit/809001	third-party-advisory
https://github.com/8421bit/MiniClaw/issues/6	issue-tracking
https://github.com/8421bit/MiniClaw/pull/7	issue-tracking, patch
https://github.com/8421bit/MiniClaw/issues/6#issue-4290453729	exploit, issue-tracking
https://github.com/8421bit/MiniClaw/commit/223c16a1088e138838dcbd18cd65a37c35ac5a84	patch
https://github.com/8421bit/MiniClaw/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.