CVE-2026-15668
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was found in picobot up to version 0.2.0, affecting the WebTool.Execute function in internal/agent/tools/web.go. Manipulation of the url argument leads to server-side request forgery (SSRF). The project has not responded to the issue report.
Risk Assessment
An attacker can exploit this SSRF to send requests to internal network resources, potentially leading to data disclosure or further compromise of the infrastructure.
Recommendation
Immediately update picobot to the latest version or implement temporary validation of the url argument before passing it to WebTool.Execute.
Other vulnerabilities in picobot
See all- CVE-2026-15669Medium
A vulnerability was found in louisho5 picobot up to version 0.2.0, affecting the ExecTool.Execute function in internal/agent/tools/exec.go, allowing OS command injection. The attack requires local access, and the exploit has been made public.
- CVE-2026-15629Medium
A link following vulnerability has been found in the Workspace Handler component of louisho5 picobot up to version 0.2.0. The issue affects the CreateSkill/GetSkill functions in internal/agent/tools/filesystem.go. The attack can be performed remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.