CVE-2026-6987: PicoClaw Web Launcher Management Plane restart command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-25 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

Sipeed PicoClaw: through 0.2.4

References

https://github.com/sipeed/picoclaw/issues/2307
https://vuldb.com/submit/796336
https://vuldb.com/vuln/359530
https://vuldb.com/vuln/359530/cti

Get alerted when CVE-2026-6987 or the next vulnerability affects your stack