Sipeed PicoClaw up to 0.2.9 pipeline_execute.go ExecTool.executeRun cwe toctou

Summaryinfo

A vulnerability, which was classified as problematic, was found in Sipeed PicoClaw up to 0.2.9. This affects the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe results in toctou. This vulnerability is cataloged as CVE-2026-16082. The attack must be initiated from a local position. Furthermore, there is an exploit available. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Sipeed PicoClaw up to 0.2.9. Affected is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-16082. The exploitability is told to be easy. Local access is required to approach this attack. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Sipeed

Name

• PicoClaw

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4
• 0.2.5
• 0.2.6
• 0.2.7
• 0.2.8
• 0.2.9

Website

• Product: https://github.com/sipeed/picoclaw/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #852944: Sipeed PicoClaw <= 0.2.9 Time-of-check Time-of-use Race Condition (CWE-367) (by Eric-i)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion