picobot vulnerabilities
3 known CVE vulnerabilities in picobot, translated and rated.
- CVE-2026-15669Medium
A vulnerability was found in louisho5 picobot up to version 0.2.0, affecting the ExecTool.Execute function in internal/agent/tools/exec.go, allowing OS command injection. The attack requires local access, and the exploit has been made public.
- CVE-2026-15668Medium
A vulnerability was found in picobot up to version 0.2.0, affecting the WebTool.Execute function in internal/agent/tools/web.go. Manipulation of the url argument leads to server-side request forgery (SSRF). The project has not responded to the issue report.
- CVE-2026-15629Medium
A link following vulnerability has been found in the Workspace Handler component of louisho5 picobot up to version 0.2.0. The issue affects the CreateSkill/GetSkill functions in internal/agent/tools/filesystem.go. The attack can be performed remotely and the exploit has been made public.