EUVD-2026-45358
GHSA-49hh-3wxf-qhw8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
TOCTOU races require precise timing to win reliably, justifying AC:H; exploitation is strictly local with low-privilege OS account and all impacts are limited.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
AnalysisAI
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privilege users to exploit the ExecTool.executeRun function in the Go-based pipeline execution agent, achieving limited confidentiality, integrity, and availability impacts. A publicly available proof-of-concept exists via GitHub issue #3081, though the vendor closed the report as 'not planned,' signaling no intent to patch. No public exploit identified at time of analysis in CISA KEV; the local-only attack vector and low impact ceiling make this a low-priority finding for most environments.
Technical ContextAI
Sipeed PicoClaw is a Go-based agent framework used for pipeline execution. The vulnerable component is the ExecTool.executeRun function in pkg/agent/pipeline_execute.go, where the 'cwe' argument is subject to a CWE-367 (Time-of-Check Time-of-Use, TOCTOU) race condition. In this class of flaw, a resource's state is validated at one point in time and then acted upon at a later point, with an attacker able to modify the resource during the intervening window. Go's goroutine scheduling model and shared memory semantics can make such races exploitable when concurrent execution paths exist around the checked argument. The affected CPE is cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*, covering all releases through 0.2.9.
RemediationAI
No vendor-released patch is available - the upstream GitHub issue was closed as 'not planned,' indicating the vendor does not intend to remediate this vulnerability. As a compensating control, restrict local interactive and shell access to PicoClaw hosts to the minimum set of trusted users, ensuring accounts that can invoke pipeline execution have no broader system privileges than required. Applying OS-level process isolation (e.g., running PicoClaw under a dedicated service account with restricted filesystem permissions) reduces the window of exploitability for the TOCTOU race. Monitoring for anomalous process execution patterns around ExecTool invocations can serve as a detective control. Organizations requiring a fix should consider forking the project to apply a local patch, replacing PicoClaw with an alternative tool, or accepting the residual risk given the low severity. Track the GitHub repository (https://github.com/sipeed/picoclaw/) for any future upstream changes.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the s
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today