The vulnerability resides in the executeCognitivePulse function of src/kernel.ts in the 8421bit MiniClaw application. Performing a specific manipulation allows an attacker to inject arbitrary operating‑system commands that are executed by the running process. This flaw maps to the unsafe use of system command facilities (CWE‑77 and CWE‑78) and can result in compromise of confidentiality, integrity, and availability by executing malicious commands on the host. While the patch commit 028f62216dee9f64833d0f1cfda7c217067ceba8 addresses the issue, the release model used by MiniClaw does not provide explicit version numbers, so the exact applicable revisions cannot be enumerated. The security notice recommends deploying the patch immediately.

MiniClaw is distributed by 8421bit and follows a rolling‑release model that continually delivers updates. Because no released tag is tied to a specific commit, all MiniClaw instances running any code prior to the patch commit 028f62216dee9f64833d0f1cfda7c217067ceba8 are considered vulnerable. The product repository lists the affected commit range up to 223c16a1088e138838dcbd18cd65a37c35ac5a84, which includes the vulnerable function.

The CVSS v3 base score of 5.3 indicates moderate severity, and the EPSS score of 3% suggests a moderate likelihood of exploitation. The vulnerability is public, with exploit code released on GitHub, and is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, likely via network interfaces that expose the executeCognitivePulse function. An adversary could trigger the injection by sending crafted data to the exposed endpoint or triggering the function through any remote procedure call that the application accepts.