Description
A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function executeCognitivePulse of the file src/kernel.ts. Performing a manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 028f62216dee9f64833d0f1cfda7c217067ceba8. To fix this issue, it is recommended to deploy a patch.
Published: 2026-05-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the executeCognitivePulse function in src/kernel.ts of the 8421bit MiniClaw application. Exploiting it enables an attacker to inject arbitrary operating‑system commands to be executed by the running process. The flaw falls under CWE-77 and CWE-78 and could lead to Remote Command Execution, compromising confidentiality, integrity, and availability of the system.

Affected Systems

MiniClaw is distributed by 8421bit. The vulnerability affects all releases up to commit 223c16a1088e138838dcbd18cd65a37c35ac5a84. As the project uses a rolling release model, specific version applicability is not pinpointed, so any currently running instance without the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS value is available, but the vulnerability is public and the exploit code has been released. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger it remotely, likely via network interfaces that expose the executeCognitivePulse function.

Generated by OpenCVE AI on May 7, 2026 at 22:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch corresponding to commit 028f62216dee9f64833d0f1cfda7c217067ceba8 as soon as possible.
  • If immediate patching is not feasible, restrict external access to the executeCognitivePulse function or remove that functionality from production environments.
  • Enforce strict input validation on all parameters passed to executeCognitivePulse, ensuring that no untrusted data is executed directly in the operating system, and apply least‑privilege permissions to the process running MiniClaw.

Generated by OpenCVE AI on May 7, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 08 May 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 07 May 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84. Affected is the function executeCognitivePulse of the file src/kernel.ts. Performing a manipulation results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 028f62216dee9f64833d0f1cfda7c217067ceba8. To fix this issue, it is recommended to deploy a patch.
Title 8421bit MiniClaw kernel.ts executeCognitivePulse os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-08T23:01:39.515Z

Reserved: 2026-05-07T16:33:08.416Z

Link: CVE-2026-8112

cve-icon Vulnrichment

Updated: 2026-05-08T23:01:32.232Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-07T22:16:37.507

Modified: 2026-05-08T15:39:09.053

Link: CVE-2026-8112

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-07T22:30:36Z

Weaknesses