The 8421bit MiniClaw software contains an OS command injection vulnerability in the executeCognitivePulse function within src/kernel.ts. This flaw allows remote attackers to inject and execute arbitrary operating system commands via crafted input. The product is delivered via a rolling release process, so affected and fixed versions are identified by commit hashes rather than version numbers. The patch commit 028f62216dee9f64833d0f1cfda7c217067ceba8 addresses this vulnerability. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized control or disruption. The CVSS score of 5.3 reflects a medium severity impact with limited but meaningful consequences to system security.

A patch identified by commit 028f62216dee9f64833d0f1cfda7c217067ceba8 is available and should be deployed to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest release that includes this patch. No vendor advisory was provided to confirm patch status, so users should verify the patch application in their environment.