The vulnerability in FoundDream miniclawd allows attackers to inject operating‑system commands via an improperly validated argument in the SkillsLoader component. This flaw can lead to arbitrary command execution, compromising the confidentiality, integrity, and availability of the system where minimclawd is installed. The weakness is categorized as CWE‑74 and CWE‑77, indicating inadequate validation of external input and OS command injection.

The affected product is FoundDream miniclawd, any version up to the last commit identified in the security advisory. Because the project follows a rolling release model, no specific version information is defined, and any release prior to the undisclosed fix is considered vulnerable.

The CVSS score of 6.9 classifies the issue as Medium severity, while the EPSS score is not available (inferred from missing data), indicating limited current exploitation evidence. The flaw can be triggered remotely, and the exploitation code is public, meaning attackers could target instances without additional access. At this time, the vulnerability is not listed in the CISA KEV catalog, but its remote nature and public exploitability indicate that an attacker could obtain full command control over a susceptible system.