CVE-2026-9452 FoundDream miniclawd Remote Command Injection

A remote command injection vulnerability, identified as CVE-2026-9452, affects FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125. The vulnerability lies in the ExecTool.execute function within the /src/tools/exec.ts file. An attacker can remotely exploit this vulnerability to execute arbitrary operating system commands on the target system. Public exploit code is available. The lack of versioning makes it difficult to determine specific affected releases. The project has been notified but remains unresponsive, indicating a potential lack of support or patching.

Attack Chain

1. The attacker identifies a vulnerable instance of FoundDream miniclawd running a version prior to or including commit 2d65665046e2222eeea76cafc8570ed546a8c125.
2. The attacker crafts a malicious request targeting the ExecTool.execute function.
3. The crafted request injects OS commands into the parameters of the ExecTool.execute function.
4. The miniclawd application processes the request, passing the injected commands to the underlying operating system without proper sanitization.
5. The operating system executes the attacker-controlled commands within the context of the miniclawd application.
6. The attacker gains arbitrary code execution on the server.
7. The attacker can then perform actions such as installing malware, exfiltrating sensitive data, or pivoting to other systems on the network.

Impact

Successful exploitation of CVE-2026-9452 allows an attacker to execute arbitrary OS commands on the affected system. This can lead to complete system compromise, data theft, and further malicious activities. Since the project is unresponsive and no fix is available, all deployments are at risk.

Recommendation

• Monitor network traffic for suspicious requests targeting the /src/tools/exec.ts endpoint with shell metacharacters, using a webserver rule as described in the next section.
• Implement input validation and sanitization on the ExecTool.execute function in miniclawd to prevent command injection, if possible.
• Until a patch is available, consider implementing a reverse proxy with strict input filtering to mitigate the risk (see example webserver rule below).