CVE-2026-16082 — Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulati…
Published: 2026-07-18 · CVSS: 4.8 · CVSS 4.0
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7