What’s Vulnerable › Vulnerabilities

CVE-2026-16082: Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-18 · updated 2026-10-24
• Weakness: CWE-362

Description

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

Affected products

• Sipeed PicoClaw: 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5 (+4)

References

• https://github.com/sipeed/picoclaw/
• https://github.com/sipeed/picoclaw/issues/3081
• https://vuldb.com/cve/CVE-2026-16082
• https://vuldb.com/submit/852944
• https://vuldb.com/vuln/379794
• https://vuldb.com/vuln/379794/cti
• https://vuldb.com/submit/852944

Get alerted when CVE-2026-16082 or the next vulnerability affects your stack