EUVD-2026-45368
GHSA-jj5m-mcrf-wh9m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low OS privileges to manipulate context inputs; no scope change, with partial impact limited to the vulnerable application across all three pillars.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
AnalysisAI
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a local low-privileged attacker to manipulate the NewContextBuilder function in pkg/agent/context.go, causing the application to load or execute functionality outside its intended control boundary. The impact is limited - partial confidentiality, integrity, and availability effects - but a publicly available proof-of-concept exploit exists. Critically, the vendor closed the disclosure issue on GitHub as 'not planned,' meaning no official patch will be released, leaving users without a vendor-supported remediation path.
Technical ContextAI
Sipeed PicoClaw (CPE: cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*) is a Go-based agent library developed by Sipeed. The vulnerability is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), a class of flaw where software imports, requires, or executes modules, plugins, or code from a source outside its intended trust boundary - commonly seen in dynamic loading patterns, plugin architectures, or path-manipulation scenarios. The specific locus is the NewContextBuilder function in pkg/agent/context.go, which constructs an execution context for the agent. If this function can be influenced by attacker-controlled input (e.g., manipulated file paths, environment variables, or configuration parameters) to reference untrusted external code, an attacker can redirect what functionality gets loaded. The CVSS 4.0 supplemental metric E:P confirms the existence of a public proof-of-concept, referenced via a GitHub issue.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor explicitly closed the disclosure issue (https://github.com/sipeed/picoclaw/issues/3075) as 'not planned' via automated bot, signaling no intention to release a fix. Organizations running PicoClaw should evaluate whether continued use is acceptable given the absence of a remediation path. As compensating controls: restrict local user accounts on systems running PicoClaw to the minimum necessary privilege set, reducing the population of users who could trigger exploitation (trade-off: operational overhead). Implement OS-level mandatory access controls such as AppArmor or SELinux profiles to constrain which directories and modules PicoClaw can access, limiting the untrusted-code-loading surface (trade-off: requires policy tuning and may break legitimate functionality). Audit and restrict write access to directories within the PicoClaw working environment to prevent placement of untrusted modules. Organizations with high-sensitivity environments should consider replacing PicoClaw with an actively maintained alternative given the vendor's non-response posture.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today