EUVD-2026-45367
GHSA-mcj8-ff8h-86ph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint (AV:N/PR:N); scope changes as server fetches out-of-bounds resources (S:C); no demonstrated availability impact (A:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: c15aac21fe05ee103a470e1104bc891754e83392. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in pkg/utils/http_guard.go fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as http://[2001:db8::5efe:127.0.0.1]. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) arises when an application fetches attacker-controlled URLs without fully validating the resolved destination. PicoClaw's web_fetch function in pkg/tools/integration/web.go provides a URL-fetching capability, likely for AI agent tool integration. The application maintains an SSRF guard in pkg/utils/http_guard.go via IsPrivateOrRestrictedIP, which blocked direct private IPv4 addresses but missed ISATAP (Intra-Site Automatic Tunnel Addressing Protocol) IPv6 encoding. ISATAP embeds a 32-bit IPv4 address in bytes 12-15 of an IPv6 address, preceded by the interface identifier 00:00:5e:fe or 02:00:5e:fe (bytes 8-11). The upstream patch (commit c15aac21fe05ee103a470e1104bc891754e83392, PR #3143) adds detection for both ISATAP variants and recursively evaluates the extracted IPv4 against the existing private-address blocklist. Affected CPE: cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:*:*:*.
RemediationAI
Apply the upstream fix from commit c15aac21fe05ee103a470e1104bc891754e83392, available via GitHub PR #3143 at https://github.com/sipeed/picoclaw/pull/3143. The patch extends IsPrivateOrRestrictedIP in pkg/utils/http_guard.go to detect ISATAP-formatted IPv6 addresses and check their embedded IPv4 component against the private-address blocklist. No specific patched release version number is confirmed from available data; verify against the project's releases page at https://github.com/sipeed/picoclaw/ before deploying. If immediate patching is not feasible, restrict network egress from the PicoClaw host at the firewall or network policy layer to deny outbound connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), and loopback (127.0.0.0/8); note this may partially impact legitimate web fetch functionality if any internal resources are intentionally fetched. Additionally, disabling the web_fetch tool integration entirely eliminates the attack surface if that capability is not required.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attack
Improper access control in Sipeed PicoClaw up to version 0.2.9 allows remote unauthenticated attackers to bypass the IP
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauth
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchToo
Missing authorization in Sipeed PicoClaw up to version 0.2.9 permits remote low-privileged attackers to invoke the rt.Re
Incorrect authorization in Sipeed PicoClaw's MQTT Channel Handler (pkg/channels/mqtt/mqtt.go) through version 0.2.9 allo
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a
Time-of-check time-of-use race condition in Sipeed PicoClaw up to version 0.2.9 allows locally authenticated low-privile
Remote command injection in PicoClaw Web Launcher Management Plane (versions up to 0.2.4) allows unauthenticated attacke
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today