cve.nowby Sazabi

GoPackage

github.com/sipeed/picoclaw

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v0.3.1 (Jun 26, 2026): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 1 high, 1 medium

Releases: 17 since v0.0.1 (Feb 9, 2026)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-36045
Affects v0.0.1 to v0.3.1 (through the newest release)
CVE-2026-6987
Affects v0.0.1 to v0.3.1 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-36045High 7.3
picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go).
Affected: through 0.1.2; all versions.
No fix released. The latest release, v0.3.1, is still affected.
CVE-2026-6987Medium 6.9
PicoClaw Web Launcher Management Plane restart command injection
Affected: through 0.2.4; all versions.
No fix released. The latest release, v0.3.1, is still affected.