Skip to content
OpenAdvisories

Package · Go

github.com/sipeed/picoclaw

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.3
    CVE-2026-36045

    picoclaw is vulnerable to OS command injection via the ExecTool component

    picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomp…

    github.com/sipeed/picoclaw Go
  • High 7.3
    CVE-2026-6987

    PicoClaw Web Launcher Management Plane restart command injection

    A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attac…

    github.com/sipeed/picoclaw Go