Description
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PicoClaw | 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sipeed/picoclaw | <= 0.2.4 | — | GHSA-6r3x-h84w-fhxx |
| Go | github.com/sipeed/picoclaw | all versions | — | GO-2026-5187 |
Advisories 1
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
References
- VDB-359530 | PicoClaw Web Launcher Management Plane restart command injection vdb-entry
- VDB-359530 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #796336 | PicoClaw V0.2.4 Command execution third-party-advisory
- https://github.com/sipeed/picoclaw/issues/2307 issue-tracking