Description
A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Based on the description, it is inferred that a flaw in the CreateSkill and GetSkill functions of Picobot's workspace handler allows an attacker to supply arbitrary URLs that the application will resolve and follow. The weakness identified is path traversal/unsanitized link following (CWE-59). The application may make HTTP or HTTPS requests on behalf of the user, remotely following arbitrary URLs.

Affected Systems

Versions of Picobot released by louisho5 up to and including 0.2.0 contain the vulnerability. Users running 0.2.0 or earlier are at risk until a patched version is installed.

Risk and Exploitability

Based on the description, it is inferred that an attacker can trigger Picobot to follow arbitrary URLs from a remote location. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The exploit could cause Picobot to make outbound HTTP or HTTPS requests on behalf of the user.

Generated by OpenCVE AI on July 31, 2026 at 10:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Picobot to a version newer than 0.2.0 where the CreateSkill/GetSkill link following flaw has been fixed
  • If an immediate upgrade is not feasible, limit outbound connections from Picobot or implement firewall rules to block unsolicited external HTTP/HTTPS connections
  • Disable or remove the CreateSkill/GetSkill feature if the application configuration allows, or otherwise restrict user input to prevent arbitrary URLs from being processed

Generated by OpenCVE AI on July 31, 2026 at 10:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title louisho5 picobot Workspace filesystem.go GetSkill link following
First Time appeared Louisho5
Louisho5 picobot
Weaknesses CWE-59
CPEs cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*
Vendors & Products Louisho5
Louisho5 picobot
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Louisho5 Picobot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T12:30:25.981Z

Reserved: 2026-07-13T17:29:56.866Z

Link: CVE-2026-15629

cve-icon Vulnrichment

Updated: 2026-07-14T12:30:21.454Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:00:06Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')