CVE-2026-15629
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A link following vulnerability has been found in the Workspace Handler component of louisho5 picobot up to version 0.2.0. The issue affects the CreateSkill/GetSkill functions in internal/agent/tools/filesystem.go. The attack can be performed remotely and the exploit has been made public.
Risk Assessment
The organization is at risk of remote file read or write outside the intended workspace directory, potentially leading to data leakage or privilege escalation.
Recommendation
Immediately update picobot to the latest available version or apply temporary WAF rules to block path manipulation in requests to CreateSkill/GetSkill functions.
Other vulnerabilities in picobot
See all- CVE-2026-15669Medium
A vulnerability was found in louisho5 picobot up to version 0.2.0, affecting the ExecTool.Execute function in internal/agent/tools/exec.go, allowing OS command injection. The attack requires local access, and the exploit has been made public.
- CVE-2026-15668Medium
A vulnerability was found in picobot up to version 0.2.0, affecting the WebTool.Execute function in internal/agent/tools/web.go. Manipulation of the url argument leads to server-side request forgery (SSRF). The project has not responded to the issue report.
Original NVD description (English source)
A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.