PT-2026-43703

CVE-2026-36045

Published

2026-05-27

Updated

2026-07-30

Description by

CVSS 3.1

7.3

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions picoclaw versions prior to 0.1.3

Description The ExecTool component (pkg/tools/shell.go) allows OS command injection. This occurs because the guardCommand() function uses an incomplete denylist of eight regular expressions to restrict shell command execution, failing to block all malicious inputs.

Recommendations Update picoclaw to a version later than 0.1.2. As a temporary workaround, restrict the use of the guardCommand() function within the ExecTool component.

Exploitability

Exploit

Fix

Impacts

Researchers

Nucleiav

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2026-36045