The 8421bit MiniClaw software up to commit 223c16a1088e138838dcbd18cd65a37c35ac5a84 contains an OS command injection vulnerability in the executeCognitivePulse function within src/kernel.ts. This vulnerability can be triggered remotely by manipulating inputs, leading to arbitrary OS command execution. The product follows a rolling release model, so traditional versioning does not apply. A patch to address this vulnerability is available under commit 028f62216dee9f64833d0f1cfda7c217067ceba8. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on affected systems, potentially compromising system integrity and confidentiality. The medium severity score reflects the moderate risk due to the ease of remote exploitation without user interaction but limited impact on system components.

A patch identified by commit 028f62216dee9f64833d0f1cfda7c217067ceba8 is available and should be deployed to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest commit that includes this fix. Patch status is confirmed by the presence of the patch commit. No additional vendor advisory information is provided.