This vulnerability involves a path traversal flaw in the isPathInside function of the executeSkillScript component in 8421bit MiniClaw, up to the specified commit version. Remote attackers can exploit this flaw by manipulating path inputs to traverse directories and potentially access files outside intended directories. The product's rolling release approach means version numbers are not fixed, but a patch commit exists to address the issue. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow an attacker to access or read files outside of the intended directory structure remotely, potentially exposing sensitive information or enabling further attacks. However, the vulnerability does not require user interaction or elevated privileges, and the impact is limited to information disclosure or unauthorized file access. There are no known active exploits in the wild currently.

A patch identified by commit e8bd4e17e9428260f2161378356affc5ce90d6ed is available and should be applied to remediate this vulnerability. Due to the rolling release model of the product, users should update to the latest release that includes this patch. Patch status is not explicitly confirmed beyond this patch reference; therefore, users should verify with the vendor or official repository for the latest remediation guidance.