EUVD-2026-43621
GHSA-r2gh-4x75-72jf
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector and low-privilege requirement per exec tool access model; no scope change as subsequent-system impact is absent.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OS command injection in louisho5 picobot up to version 0.2.0 allows local low-privileged attackers to execute arbitrary operating system commands through the ExecTool.Execute function in internal/agent/tools/exec.go. A publicly available proof-of-concept exploit exists (GitHub issue #43), elevating practical risk despite the moderate CVSS 4.0 score of 4.8. No patch has been issued as the project maintainer has not responded to responsible disclosure, leaving all known deployments persistently exposed.
Technical ContextAI
picobot is a small Go-based agent/bot application (CPE: cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*) that includes an exec tool component at internal/agent/tools/exec.go. The flaw is classified as CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), meaning user-controlled input is passed without adequate sanitization to an underlying OS command execution call within ExecTool.Execute. In Go, this typically manifests when exec.Command is called with shell-interpreted strings or when os.Exec-family calls concatenate untrusted input without argument isolation, allowing shell metacharacters to redirect command flow. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attack is local, low-complexity, and requires only low OS privileges with no special attack requirements.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the responsible disclosure filed via GitHub issue #42. Upstream fix availability should be monitored at https://github.com/louisho5/picobot/. As compensating controls, administrators should restrict OS-level execution permissions on the picobot binary using chmod or ACLs to prevent low-privileged users from invoking it directly. Deploying picobot in isolated single-user environments or within containers with a restricted syscall profile (e.g., seccomp) limits the blast radius of successful command injection. If the exec tool feature is not required, disabling or removing the ExecTool component from the build is the most effective mitigation, though this requires source-level modification. Avoid deploying picobot in shared or multi-tenant systems until a patched release is confirmed.
Server-side request forgery in louisho5 picobot up to version 0.2.0 allows authenticated remote attackers to manipulate
Link-following vulnerability in louisho5 picobot up to version 0.2.0 allows a remote, low-privileged attacker to travers
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today