Description
A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-14
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the ExecTool.Execute function of Picobot. An attacker who can provide crafted input to this function can cause the program to invoke arbitrary operating‑system commands. The vulnerability maps to CWE‑77 and CWE‑78. The effect is that a local user with access to the exec tool can run commands with the user’s privileges, potentially compromising system integrity and confidentiality.

Affected Systems

The affected product is Louisho5 Picobot up to and including version 0.2.0. No official patch has been released by the developer, and the project has not addressed the issue yet.

Risk and Exploitability

The CVSS score of 4.8 indicates low severity. The EPSS score is below 1%, suggesting a very low probability of widespread exploitation, but the public availability of an exploit means that the risk is not negligible for local users. This vulnerability is not listed in the CISA KEV catalog, so no additional mitigation guidance is available from that source. Because execution is local, an attacker who can influence the ExecTool.Execute input can run arbitrary OS commands with the application’s privileges.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict local user privileges so that only trusted users can invoke Picobot’s ExecTool.Execute functionality.
  • Disable or remove the ExecTool.Execute feature if it is not required for business operations.
  • Continuously monitor Picobot logs for unexpected command‑execution patterns and investigate any anomalies promptly.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection
First Time appeared Louisho5
Louisho5 picobot
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*
Vendors & Products Louisho5
Louisho5 picobot
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Louisho5 Picobot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T12:40:52.008Z

Reserved: 2026-07-13T21:12:09.590Z

Link: CVE-2026-15669

cve-icon Vulnrichment

Updated: 2026-07-14T12:40:43.175Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T11:00:06Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')