Sipeed PicoClaw CVE-2026-16197

Exploitation requires the Feishu channel integration to be actively configured and running in the PicoClaw deployment - the vulnerable code is exclusively in the Feishu-specific handler pkg/channels/feishu/feishu_64.go and is not reachable without Feishu integration enabled. The CVSS 4.0 vector specifies PR:L, meaning the attacker must hold a valid authenticated Feishu account and be a member of a Feishu group where a PicoClaw bot is present. There is no requirement for PicoClaw-level administrative credentials. Exploitation is constrained to the Feishu group messaging context; PicoClaw deployments using only other channel integrations (non-Feishu) are not affected. The absence of a vendor patch means all instances running version 0.2.9 or earlier with Feishu enabled remain exposed.

The CVSS 4.0 score of 2.1 is notably low, reflecting meaningful constraints: the PR:L metric confirms exploitation requires an authenticated Feishu session, and the VC:L/VI:L/VA:L metrics indicate only partial impact across CIA triad dimensions with no scope change to subsequent systems (SC:N/SI:N/SA:N). The E:P modifier in the threat component confirms publicly available exploit code, elevating practical risk above theoretical. No CISA KEV listing exists, and EPSS data was not provided, suggesting this has not been observed in broad exploitation campaigns. The combination of a POC, no patch, and an abandoned GitHub issue is concerning for organizations running PicoClaw with Feishu integration - however, the narrow deployment footprint and authentication prerequisite significantly constrain real-world blast radius. This is a low-severity, real vulnerability rather than a high-CVSS-but-low-reality issue; risk is genuine but bounded by the niche product footprint.

An authenticated Feishu user who is a member of a group where PicoClaw is deployed sends a specially crafted group message targeting the handleMessageReceive function. Because authorization checks are absent, the message triggers a privileged PicoClaw action without the sender having been granted the necessary permissions. A proof-of-concept demonstrating this behavior is publicly documented in GitHub issue #3082.