CVSS 4.0
5.5 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PCVE-2026-6987
Medium (5.5) in sipeed picoclaw. EPSS 3.4% chance of exploitation in the next 30 days.
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-74, CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sipeed:picoclaw
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6r3x-h84w-fhxx | Go | github.com/sipeed/picoclaw | <=0.2.4 | no fix published |
| GO-2026-5187 | Go | github.com/sipeed/picoclaw | all versions | no fix published |