The vulnerability CVE-2026-8235 in 8421bit MiniClaw 0.8.0 and 0.9.0 arises from improper handling of input in the resolveSkillScriptPath function of src/kernel.ts, leading to OS command injection. This allows an attacker with low privileges and no user interaction to execute arbitrary OS commands with limited impact on confidentiality, integrity, and availability. The issue is fixed by a patch identified by commit 223c16a1088e138838dcbd18cd65a37c35ac5a84. The CVSS 4.0 vector indicates the attack requires adjacent network access and low complexity, with no privileges required and no user interaction, but with limited impact. No vendor advisory or official remediation level is provided, but the patch commit is known.

Successful exploitation of this vulnerability can lead to execution of arbitrary operating system commands on the affected system. The impact is rated medium with limited confidentiality, integrity, and availability impact. The attacker requires adjacent network access and low privileges. There is no evidence of exploitation in the wild at this time.

A patch identified by commit 223c16a1088e138838dcbd18cd65a37c35ac5a84 is available and should be applied to affected versions 0.8.0 and 0.9.0 of 8421bit MiniClaw. Since the vendor advisory or official remediation level is not provided, users should verify the patch from the official source and apply it promptly to mitigate the vulnerability.