Sipeed PicoClaw CVE-2026-16082

Exploitation requires local access to the target operating system and a low-privilege OS-level account, confirmed by CVSS 4.0 metrics AV:L and PR:L. The attacker must be able to trigger or observe execution of the ExecTool.executeRun function, meaning PicoClaw must be actively processing pipeline tasks on the host. Successfully exploiting the TOCTOU race requires precise timing to substitute the 'cwe' argument in the narrow window between its check and use - this timing dependency limits reliability and raises the practical bar for exploitation. No remote or network-based attack path exists; AV:L is confirmed and no scope change applies (SC:N/SI:N/SA:N). Systems where PicoClaw runs in isolated service accounts with restricted local login access, or where untrusted users have no local shell access, are not realistically exposed.

The CVSS 4.0 score of 4.8 (Medium) accurately reflects the constrained impact profile: AV:L limits exploitation strictly to local system access, and VC:L/VI:L/VA:L confirm only marginal impacts across all three pillars. The E:P modifier acknowledges the publicly available proof-of-concept. EPSS data was not included in the intelligence feed, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV entry means no confirmed active exploitation has been documented by U.S. government threat intelligence. The vendor's explicit 'not planned' closure of the GitHub issue removes any remediation horizon, which marginally elevates residual risk for operators relying on the vendor for a fix. Overall risk is low for most environments: local access is a hard prerequisite, the impact ceiling is limited, and the product has a niche footprint. The public POC elevates the threat slightly for scenarios where local access to a PicoClaw host is already partially compromised by a threat actor.

A locally authenticated user with low-privilege access to a host running active PicoClaw pipeline jobs triggers the ExecTool.executeRun function and races to substitute the value of the 'cwe' argument between the moment it is validated and the moment it is consumed, exploiting the timing window inherent to the TOCTOU flaw. A publicly available proof-of-concept referenced in GitHub issue #3081 provides a working template for timing this race. If the race is won, the attacker achieves limited read access to sensitive pipeline state or introduces minor unauthorized modifications to execution behavior.