This vulnerability in FoundDream miniclawd up to commit 2d65665046e2222eeea76cafc8570ed546a8c125 allows remote command injection via manipulation of the 'requires.bins' argument in the SkillsLoader component's /src/application/skills-loader.ts file. The flaw enables attackers to execute arbitrary commands on the affected system without requiring privileges or user interaction. The product's rolling release model means specific affected or patched versions are not clearly identified. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). The vendor has not yet issued a patch or official remediation guidance, and the exploit is publicly available.

Successful exploitation could allow remote attackers to execute arbitrary commands on the affected system, potentially leading to unauthorized control or disruption of the application. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known active exploitation in the wild has been reported to date.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded and no patch links exist, users should monitor the vendor's project for updates. Until a fix is released, consider restricting access to the affected component or applying application-level controls to validate and sanitize inputs related to 'requires.bins'. Patch status is not yet confirmed — check the vendor advisory or project repository regularly for current remediation guidance.