CVE-2026-15668

Name of the Vulnerable Software and Affected Versions louisho5 picobot versions prior to 0.2.1

Description A remote attacker can trigger server-side request forgery (SSRF) by manipulating the url argument within the WebTool.Execute() function located in the internal/agent/tools/web.go file of the web Tool component. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the WebTool.Execute() function to minimize the risk of exploitation.