Sipeed PicoClaw CVE-2026-16195

Exploitation requires the attacker to hold low-privilege authenticated access to the WeCom (WeChat Work) environment connected to the PicoClaw instance - unauthenticated external exploitation is not indicated by the CVSS PR:L metric. The WeCom channel integration must be enabled and configured, as the vulnerability is specific to the wecom.go component's group message handling path. Exploitation is limited to scenarios where: (1) the attacker has a valid WeCom identity recognized by the integrated environment, and (2) the PicoClaw instance is configured to process WeCom group messages via the dispatchIncoming function. Exploitation is constrained to the vulnerable system's own resources (CVSS 4.0 SC:N/SI:N/SA:N indicates no scope change to subsequent systems). Non-WeCom channel configurations are not affected by this specific flaw.

The CVSS 4.0 base score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:L/VI:L/VA:L reflects a remotely exploitable flaw requiring low-privilege access, with limited impact across confidentiality, integrity, and availability. The PR:L metric is a meaningful limiting factor - exploitation is not unauthenticated; the attacker must hold some level of access to the WeCom-integrated environment. Real-world risk is modestly elevated by the public availability of a proof-of-concept exploit, which lowers the technical bar for exploitation. However, no CISA KEV listing exists, suggesting active exploitation has not been broadly observed. No EPSS score was provided in the intelligence data, so quantitative exploitation probability cannot be stated. The primary risk amplifier is the low attack complexity (AC:L, AT:N) once authenticated access is obtained. The GitHub issue referenced as the exploit source was closed automatically due to inactivity, raising questions about vendor responsiveness but not invalidating the vulnerability. Overall this represents a medium-priority item for organizations using PicoClaw with WeCom integration, elevated if the deployment is internet-facing.

An attacker with low-privilege access to the WeCom-integrated PicoClaw environment - such as a regular WeCom group member - crafts a specially formed group message targeting the dispatchIncoming endpoint. The flawed authorization logic in wecom.go fails to validate that the sender is permitted to trigger the requested action or access protected resources, allowing the attacker to execute operations or retrieve data beyond their assigned permission level. A public proof-of-concept is available via the GitHub issue, reducing the skill threshold required for exploitation.