Description (CNA)
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Sipeed / PicoClaw | affected 0.2.0; affected 0.2.1; affected 0.2.2; affected 0.2.3; affected 0.2.4; affected 0.2.5; affected 0.2.6; affected 0.2.7; affected 0.2.8; affected 0.2.9 |
CWE
CWE-367, CWE-362
References
- https://vuldb.com/vuln/379794
- https://vuldb.com/vuln/379794/cti
- https://vuldb.com/cve/CVE-2026-16082
- https://vuldb.com/submit/852944
- https://github.com/sipeed/picoclaw/issues/3081
- https://github.com/sipeed/picoclaw/
ADP enrichment
No English description supplied.