EUVD-2026-42757
GHSA-jfqv-gfxr-5hm7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring user interaction (UI:R per CVSS 4.0 UI:P); no privileges needed; low CIA impact aligned with CVSS 4.0 VC:L/VI:L/VA:L; no scope change as SC/SI/SA are all N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
AnalysisAI
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchTool.Execute function within the Guarded Web Fetch Flow component, causing the server to issue arbitrary outbound requests on behalf of the attacker. The vulnerability carries a CVSS 4.0 base score of 2.1, reflecting limited confidentiality, integrity, and availability impact with no subsequent-system scope change. A public exploit has been released (E:P confirmed), but no vendor patch exists - the upstream GitHub issue was closed automatically due to inactivity, not resolution.
Technical ContextAI
The affected product is Sipeed PicoClaw (CPE: cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*), versions up to and including 0.2.9, published by Sipeed, a vendor known primarily for RISC-V embedded hardware. The vulnerable logic resides in pkg/tools/integration/web.go within a subsystem named the 'Guarded Web Fetch Flow' - a label implying an intended SSRF-prevention mechanism (e.g., allowlist or blocklist validation) that can be bypassed. The root cause is CWE-918 (Server-Side Request Forgery): user-controlled input reaches a server-side HTTP fetch operation without sufficient sanitization, enabling the server to be redirected toward internal network resources, loopback services, or cloud instance metadata endpoints (e.g., 169.254.169.254) that are inaccessible directly from the attacker's vantage point. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms the flaw is network-reachable at low complexity but requires passive user interaction to trigger.
RemediationAI
No vendor-released patch has been identified at time of analysis. The upstream GitHub issue (https://github.com/sipeed/picoclaw/issues/3078) was closed automatically due to inactivity rather than a code fix, and no patched release version has been confirmed via any reference. Operators should immediately restrict network-level access to the WebFetchTool.Execute endpoint using firewall rules or reverse proxy ACLs, allowing only trusted internal clients to initiate web fetch operations - this eliminates the AV:N attack surface without application changes. Additionally, implement strict egress filtering on the host running PicoClaw to block outbound requests to RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud instance metadata endpoints (169.254.169.254); this limits SSRF blast radius even if bypass occurs but may break legitimate fetch functionality against internal targets. Monitor VulDB advisory https://vuldb.com/vuln/377257 and the PicoClaw GitHub repository for patch releases.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today