picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-36045 · Microsoft / collected KEV context

GHSA-cv2p-68f4-f4pw

GO-2026-5867

cve-program · CVE-2026-36045

• https://github.com/sipeed/picoclaw/releases/tag/v0.1.2
• https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68

nvd · CVE-2026-36045

• https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68
• https://github.com/sipeed/picoclaw/releases/tag/v0.1.2

osv · GHSA-cv2p-68f4-f4pw

• https://nvd.nist.gov/vuln/detail/CVE-2026-36045
• https://github.com/sipeed/picoclaw/commit/01d694b9985a66c3d7119fc9f74ce8ed4f0f21b5
• https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68
• https://github.com/sipeed/picoclaw
• https://github.com/sipeed/picoclaw/releases/tag/v0.1.2

osv · GO-2026-5867

• https://github.com/advisories/GHSA-cv2p-68f4-f4pw
• https://nvd.nist.gov/vuln/detail/CVE-2026-36045
• https://github.com/sipeed/picoclaw/commit/01d694b9985a66c3d7119fc9f74ce8ed4f0f21b5
• https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68
• https://github.com/sipeed/picoclaw/releases/tag/v0.1.2

No related operational record is retained in the current change model.