CVE-2026-16085: fallo de gravedad media en Sipeed PicoClaw
Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 4.8epss 0.2%
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
Sipeed · PicoClawPoCs públicas encontradas — 1
cve_referencegithub.com/sipeed/picoclaw/issues/3075no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Sipeed PicoClaw
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-16083MEDIUMSipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replayEPSS 0.7%CVE-2026-16198MEDIUMSipeed PicoClaw First Run Setup access_control.go authentication bypassEPSS 0.6%CVE-2026-16084MEDIUMSipeed PicoClaw web.go web_fetch server-side request forgeryEPSS 0.6%CVE-2026-15319MEDIUMSipeed PicoClaw Launcher access_control.go IPAllowlist access controlEPSS 0.5%CVE-2026-15317MEDIUMSipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgeryEPSS 0.4%CVE-2026-16196MEDIUMSipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgeryEPSS 0.4%