IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-05-27 14:16

MODIFIED

2026-05-27 14:16

EPSS (Prob. Exploit)

1.77%

Top 22.0%

DATA SOURCES:

NVD 🔗 2026-05-27 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-cv2p-68f4-f4pw HIGH

picoclaw is vulnerable to OS command injection via the ExecTool component

AFFECTED PACKAGES:

GO / github.com/sipeed/picoclaw

<= 0.1.2

> HISTORIQUE DES MODIFICATIONS

Première apparition

27/05/2026 14:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 5 months ago

> REFERENCES

https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68