CVE-2026-15629

Name of the Vulnerable Software and Affected Versions louisho5 picobot versions prior to 0.2.1

Description A weakness in the Workspace Handler component allows remote attackers to perform link following. This issue occurs within the CreateSkill() and GetSkill() functions located in the internal/agent/tools/filesystem.go file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the CreateSkill() and GetSkill() functions to minimize the risk of exploitation.