Executive brief
8421bit MiniClaw is an intelligent micro-kernel used to enhance AI assistants and copilots with memory and evolutionary capabilities. A security flaw in its heartbeat function allows a remote attacker to execute unauthorized operating system commands. This could lead to a complete takeover of the system running the AI assistant, potentially exposing sensitive user data or allowing the attacker to disrupt operations.
Technical details
An OS command injection vulnerability exists in the executeCognitivePulse function within src/kernel.ts of 8421bit MiniClaw. The vulnerability stems from improper neutralization of special elements used in a command, specifically within the heartbeat mechanism. A remote attacker with low privileges can exploit this by manipulating inputs that are subsequently passed to a system shell via vulnerable child_process functions like exec. This allows for arbitrary command execution on the host system. The issue has been addressed in commit 028f62216dee9f64833d0f1cfda7c217067ceba8 by migrating from exec to safer alternatives like spawn.
Affected products
- 8421bit MiniClaw up to 223c16a1088e138838dcbd18cd65a37c35ac5a84
Timeline
- 2026-04-30: patched: Fix heartbeat command injection commit 028f62216dee9f64833d0f1cfda7c217067ceba8
- 2026-05-07: disclosed: CVE-2026-8112 published