CVE-2026-16085 PUBLISHED

Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere

Assigner: VulDB
Reserved: 17.07.2026 Published: 18.07.2026 Updated: 18.07.2026

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 4.8

Product Status

Vendor Sipeed
Product PicoClaw
Versions
  • Version 0.2.0 is affected
  • Version 0.2.1 is affected
  • Version 0.2.2 is affected
  • Version 0.2.3 is affected
  • Version 0.2.4 is affected
  • Version 0.2.5 is affected
  • Version 0.2.6 is affected
  • Version 0.2.7 is affected
  • Version 0.2.8 is affected
  • Version 0.2.9 is affected

Credits

  • Eric-i (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Inclusion of Functionality from Untrusted Control Sphere CWE