Sipeed PicoClaw CVE-2026-16085

The attacker must have local system access (AV:L) with at least low-level operating system privileges (PR:L) on a host running Sipeed PicoClaw version 0.2.9 or earlier. The vulnerability requires the ability to influence inputs, file paths, environment variables, or configuration data consumed by the NewContextBuilder function in pkg/agent/context.go at runtime - the exact mechanism by which the untrusted control sphere inclusion is triggered is not fully specified in available data beyond the function reference. No user interaction is required (UI:N) and no special attack timing or race conditions are needed (AC:L, AT:N). Remote unauthenticated exploitation is explicitly ruled out by the local attack vector. Exploitation is further limited by the niche deployment footprint of PicoClaw and the partial (low) impact ceiling across confidentiality, integrity, and availability - an attacker already requiring local access gains only incremental capability.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) yields a moderate score of 4.8, reflecting a local attack with low privilege requirements, no special conditions, and limited partial impact across all three pillars with no scope change to subsequent systems. The local attack vector (AV:L) is the most significant risk-reducing factor - remote exploitation is not possible under this vector, substantially narrowing the attacker population to those who already have a foothold on the target system. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. This CVE is not listed in the CISA KEV catalog, confirming no known active widespread exploitation. The public PoC (E:P) elevates the practical risk modestly beyond theoretical, as the technique is documented and reproducible. The vendor's decision to mark the issue 'not planned' removes any remediation trajectory, which increases long-term exposure for organizations that continue using PicoClaw. Overall, this is a real but narrow risk: low real-world priority for most organizations due to local-only exploitation, low impact ceiling, and a niche product with limited enterprise deployment.

A local attacker with low-privileged access to a system running Sipeed PicoClaw up to 0.2.9 crafts or places a malicious module or resource in a location accessible to the NewContextBuilder function, manipulating the context it constructs to reference attacker-controlled functionality. Because a public proof-of-concept is available via the GitHub issue at https://github.com/sipeed/picoclaw/issues/3075, the exploitation technique is documented and reproducible with low technical barrier. The attacker achieves limited read access to application data, partial modification capability, and minor disruption to availability - sufficient for privilege escalation staging or data exfiltration within the application's trust scope.