CVE-2026-16082

MEDIUM 5.3

Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

CWE	CWE-367 CWE-362
Vendor	sipeed
Product	picoclaw
Published	Jul 18, 2026

Stay Ahead of the Next One

Get instant alerts for sipeed picoclaw

Be the first to know when new medium vulnerabilities affecting sipeed picoclaw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Sipeed / PicoClaw

0.2.0 0.2.1 0.2.2 0.2.3 0.2.4 0.2.5 0.2.6 0.2.7 0.2.8 0.2.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/379794 vuldb.com: https://vuldb.com/vuln/379794/cti vuldb.com: https://vuldb.com/cve/CVE-2026-16082 vuldb.com: https://vuldb.com/submit/852944 github.com: https://github.com/sipeed/picoclaw/issues/3081 github.com: https://github.com/sipeed/picoclaw/

Credits

🔍 Eric-i (VulDB User) VulDB CNA Team