CVE-2026-15317: falha de média gravidade em Sipeed PicoClaw
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.4%
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Sipeed · PicoClawPoCs públicas encontradas — 1
cve_referencegithub.com/sipeed/picoclaw/issues/3078não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Sipeed PicoClaw
No mesmo produto, das mais perigosas para as menos.
CVE-2026-16083MEDIUMSipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replayEPSS 0.7%CVE-2026-16198MEDIUMSipeed PicoClaw First Run Setup access_control.go authentication bypassEPSS 0.6%CVE-2026-16084MEDIUMSipeed PicoClaw web.go web_fetch server-side request forgeryEPSS 0.6%CVE-2026-15319MEDIUMSipeed PicoClaw Launcher access_control.go IPAllowlist access controlEPSS 0.5%CVE-2026-16196MEDIUMSipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgeryEPSS 0.4%CVE-2026-15320MEDIUMSipeed PicoClaw pico.go rt.ReloadConfig authorizationEPSS 0.4%