CVE-2026-15317

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0

Description A security flaw in the Guarded Web Fetch Flow component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue resides in the WebFetchTool.Execute() function within the pkg/tools/integration/web.go file.

Recommendations Update to a version newer than 0.2.9. As a temporary workaround, restrict access to the WebFetchTool.Execute() function to minimize the risk of exploitation.