picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.
References
Configurations
No configuration.
History
23 Oct 2026, 22:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) picoclaw menor o igual a v0.1.2 y anteriores es vulnerable a inyección de comandos del sistema operativo a través del componente ExecTool (pkg/tools/shell.go). La función guardCommand() intenta restringir la ejecución de comandos de shell utilizando una lista negra de 8 expresiones regulares, pero la lista negra está incompleta. |
19 Oct 2026, 22:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
Information
Published : 2026-05-27 14:16
Updated : 2026-10-23 22:10
NVD link : CVE-2026-36045
Mitre link : CVE-2026-36045
CVE.ORG link : CVE-2026-36045
JSON object : View
Products Affected
No product.
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')