CVE-2026-15669
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability was found in louisho5 picobot up to version 0.2.0, affecting the ExecTool.Execute function in internal/agent/tools/exec.go, allowing OS command injection. The attack requires local access, and the exploit has been made public.
Risk Assessment
The organization faces the risk of local attackers executing arbitrary commands, potentially leading to privilege escalation, data theft, or system compromise.
Recommendation
Immediately update picobot to the latest patched version or disable the exec Tool component. Until a fix is available, restrict local access to the system.
Other vulnerabilities in picobot
See all- CVE-2026-15668Medium
A vulnerability was found in picobot up to version 0.2.0, affecting the WebTool.Execute function in internal/agent/tools/web.go. Manipulation of the url argument leads to server-side request forgery (SSRF). The project has not responded to the issue report.
- CVE-2026-15629Medium
A link following vulnerability has been found in the Workspace Handler component of louisho5 picobot up to version 0.2.0. The issue affects the CreateSkill/GetSkill functions in internal/agent/tools/filesystem.go. The attack can be performed remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.