Vulnerability · Published Apr 25, 2026 · Assigned by VulDB

CVE-2026-6987PicoClaw Web Launcher Management Plane restart command injection

High 7.3

In plain English

A high-severity command injection in PicoClaw. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)3.4%top 11.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/sipeed/picoclaw	no fix listed	GHSA-6r3x-h84w-fhxx
Go	github.com/sipeed/picoclaw	no fix listed	GO-2026-5187

Affected products (as reported)

Vendor	Product	Versions
n/a	PicoClaw	0.2.00.2.10.2.20.2.30.2.4

Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-359530 | PicoClaw Web Launcher Management Plane restart command injection vdb-entry
VDB-359530 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #796336 | PicoClaw V0.2.4 Command execution third-party-advisory
https://github.com/sipeed/picoclaw/issues/2307 issue-tracking