https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-25T05:41:51.370006+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322396 EUVD-2026-322396 2026-10-25T05:41:51.372217+00:00 EUVD-2026-322396 https://cve.radiocsirt.org/vuln/fkie_cve-2026-36045 fkie_cve-2026-36045 2026-10-25T05:41:51.372249+00:00

picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.

 https://cve.radiocsirt.org/vuln/ghsa-cv2p-68f4-f4pw GHSA-cv2p-68f4-f4pw — picoclaw is vulnerable to OS command injection via the ExecTool component 2026-10-25T05:41:51.372280+00:00

Affected: Go: github.com/sipeed/picoclaw

picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete.