CVE-2026-8235

A vulnerability was detected in 8421bit MiniClaw 0.8.0/0.9.0. This issue affects the function resolveSkillScriptPath of the file src/kernel.ts of the component System Command Handler. The manipulation results in os command injection. The exploit is now public and may be used. The patch is identified as 223c16a1088e138838dcbd18cd65a37c35ac5a84. It is best practice to apply a patch to resolve this issue.

• CWE-77
• CWE-78

• https://github.com/8421bit/MiniClaw/
• https://github.com/8421bit/MiniClaw/commit/223c16a1088e138838dcbd18cd65a37c35ac5a84
• https://github.com/8421bit/MiniClaw/issues/6
• https://github.com/8421bit/MiniClaw/issues/6#issue-4290453729
• https://github.com/8421bit/MiniClaw/pull/7
• https://vuldb.com/submit/809001
• https://vuldb.com/vuln/362455
• https://vuldb.com/vuln/362455/cti
• https://github.com/8421bit/MiniClaw/issues/6

Published

May 10, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82331Improper link resolution before file access ('link following…9.8
• CVE-2026-82333multer is a middleware for handling multipart/form-data in N…7.5
• CVE-2026-8234A security vulnerability has been detected in EFM ipTIME A80…8.8
• CVE-2026-82340IBM Guardium Data Protection 12.2 is vulnerable to unauthent…9.8
• CVE-2026-82343A flaw was found in the file-psd plugin in GIMP. When proces…6.1
• CVE-2026-82346A potential security vulnerability has been identified in th…7
• CVE-2026-82355When a request to the Airflow core API carries both a sessio…4.2
• CVE-2026-82356Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA k…7.5
• CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined …4.3
• CVE-2026-82364A security vulnerability has been detected in macrozheng mal…4.2
• CVE-2026-82367Exposure of Data Element to Wrong Session vulnerability in a…2.3
• CVE-2026-82368Insecure access controls on internal service ports in Brocad…8.7