CVE-2026-36045
picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell comma…
Published: 2026-05-27 · CVSS: 7.3 · CVSS 3.1
picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7