| Título | Sipeed PicoClaw <= 0.2.9 Time-of-check Time-of-use Race Condition (CWE-367) |
|---|
| Descripción | # Technical Details
A TOCTOU race condition exists in the `exec` approval workflow in `pkg/agent/pipeline_execute.go`, `pkg/agent/hooks.go`, and `pkg/tools/shell.go` of PicoClaw.
The application fails to bind the directory identity reviewed by approval hooks to the directory ultimately used for command execution. Approval receives a raw mutable `cwd` string, while `ExecTool.executeRun()` later re-resolves symlinks immediately before launching the process.
# Vulnerable Code
File: `pkg/agent/pipeline_execute.go`
Method: tool approval request construction
Why: Passes raw `toolArgs`, including `cwd`, to approval hooks.
File: `pkg/agent/hooks.go`
Method: `ToolApprovalRequest`
Why: Stores `Arguments map[string]any`, so approval policies reason about an unbound path string.
File: `pkg/tools/shell.go`
Method: `ExecTool.executeRun`
Why: Calls `filepath.EvalSymlinks(cwd)` after approval and before `runSync`, allowing a symlink target swap to change the execution directory.
# Reproduction
1. Configure PicoClaw with hooks enabled and the `exec` tool enabled.
2. Create a workspace-local symlink `cwd-link` initially pointing to a safe directory.
3. Trigger an `exec` tool call using `cwd-link` and pause while approval is pending.
4. Retarget `cwd-link` to another workspace directory before execution resumes.
5. Observe approval saw the safe directory, but execution runs in the attacker-selected directory.
# Impact
- Breaks approval integrity for directory-sensitive command execution.
- Allows relative reads, writes, and command behavior to differ from what was approved.
- Undermines deployments that rely on approval hooks as a safety boundary for `exec`. |
|---|
| Fuente | ⚠️ https://github.com/sipeed/picoclaw/issues/3081 |
|---|
| Usuario | Eric-i (UID 97584) |
|---|
| Sumisión | 2026-06-09 13:29 (hace 1 mes) |
|---|
| Moderación | 2026-07-17 15:50 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 379794 [Sipeed PicoClaw hasta 0.2.9 pipeline_execute.go ExecTool.executeRun cwe condición de carrera] |
|---|
| Puntos | 20 |
|---|