This vulnerability in FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 involves OS command injection via the ExecTool.execute function in /src/tools/exec.ts. Remote attackers can exploit this flaw to execute arbitrary operating system commands. The vulnerability was reported early to the project, but no vendor response or patch has been issued. The product lacks versioning, so affected and unaffected versions cannot be clearly distinguished. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized system control or data compromise. The medium severity score indicates moderate risk, with limited impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should consider applying workarounds such as restricting network access to the vulnerable service or employing application-layer filtering to block malicious inputs targeting ExecTool.execute. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.