FoundDream miniclawd SkillsLoader skills-loader.ts which command injection

Vulnerability

A command injection vulnerability exists in FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125. The flaw resides in the which() function of the /src/application/skills-loader.ts file within the SkillsLoader component [1]. The function directly concatenates unsanitized input from the requires.bins argument into a shell command executed via execSync(), as seen in the code: execSync(which ${command}, { stdio: "ignore" }) [2]. The bins value is loaded from untrusted external SKILL.md files with no validation, sanitization, or escaping [2]. The product uses a rolling release model, so specific version numbers are not available; only the commit hash is known [1][2].

Exploitation

An attacker can initiate the attack remotely by creating or modifying a skill file (SKILL.md) that contains malicious requires.bins metadata. The skill file must be loaded by the application—for example, through listSkills(true) or any method that triggers dependency checks [2]. No authentication is required if the attacker can write a skill file to a location processed by miniclawd. The proof of concept involves setting "bins": ["dummy; touch /tmp/pwned"] within the skill metadata, which results in the shell command which dummy; touch /tmp/pwned being executed [2]. The exploit is publicly available [1].

Impact

Successful exploitation leads to arbitrary system command execution with the privileges of the miniclawd process [2]. Depending on the process's permissions, this could result in full system compromise, including data loss, privilege escalation, or backdoor installation [2]. The CIA impact is complete loss of confidentiality, integrity, and availability within the context of the affected system.

Mitigation

No official fix has been released. The project maintainer was informed via an issue report but has not responded as of the publication date [1]. As a workaround, users can avoid loading untrusted skill files or disable the SkillsLoader component. The recommendation from the disclosure is to replace execSync() with spawnSync() using an argument array to avoid shell injection, and to add input validation for command names [2]. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing.