EUVD-2026-43619
GHSA-95cp-92vm-rcpc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege auth; scope unchanged per 4.0 SC:N; partial C/I/A impact consistent with provided 4.0 VC:L/VI:L/VA:L metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in louisho5 picobot up to version 0.2.0 allows authenticated remote attackers to manipulate the url argument of the WebTool.Execute function in internal/agent/tools/web.go, causing the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a CVSS 4.0 score of 5.3 with low-privilege authentication required and has publicly available exploit code disclosed via a GitHub issue report. The upstream project has not responded to the responsible disclosure, meaning no patch is available at time of analysis.
Technical ContextAI
The affected component is the web Tool handler in picobot, a Go-based agent framework developed by louisho5 (CPE: cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:* covering all versions through 0.2.0). The vulnerable code path is WebTool.Execute in internal/agent/tools/web.go, which processes a user-supplied url parameter without adequate validation or restriction of destination. CWE-918 (Server-Side Request Forgery) describes this root cause: the server blindly forwards attacker-controlled URLs, enabling access to internal network resources, cloud metadata endpoints (e.g., 169.254.169.254), or loopback services inaccessible from the public internet. Since picobot is an agent framework with web-fetching capability as a built-in tool, SSRF is a natural and high-impact attack surface for this class of software.
RemediationAI
No vendor-released patch has been identified at time of analysis - the upstream maintainer had not responded to the responsible disclosure at the time of CVE publication. The primary recommended action is to avoid deploying picobot in network-accessible configurations until a fix is released, or to restrict access to the picobot instance to trusted, authenticated users only, reducing the impact of the PR:L authentication requirement. As a specific compensating control, operators should disable or remove the web tool component if it is not required for their use case, eliminating the SSRF attack surface entirely. If the web tool must remain active, deploy an egress proxy or firewall rule on the picobot host that blocks outbound requests to RFC-1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16), which prevents the most dangerous SSRF abuse targeting cloud metadata and internal services. Monitor the GitHub repository at https://github.com/louisho5/picobot for any patch releases. Track the VulDB entry at https://vuldb.com/vuln/378162 for updated remediation guidance.
Link-following vulnerability in louisho5 picobot up to version 0.2.0 allows a remote, low-privileged attacker to travers
OS command injection in louisho5 picobot up to version 0.2.0 allows local low-privileged attackers to execute arbitrary
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today