CVE-2026-15669

louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 4.8 Medium EPSS 1.1% KEV · Not listed
Description
A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A flaw exists in the ExecTool.Execute function of Picobot. An attacker who can provide crafted input to this function can cause the program to invoke arbitrary operating‑system commands. The vulnerability maps to CWE‑77 and CWE‑78. The effect is that a local user with access to the exec tool can run commands with the user’s privileges, potentially compromising system integrity and confidentiality.

Affected Systems

The affected product is Louisho5 Picobot up to and including version 0.2.0. No official patch has been released by the developer, and the project has not addressed the issue yet.

Risk and Exploitability

The CVSS score of 4.8 indicates low severity. The EPSS score is below 1%, suggesting a very low probability of widespread exploitation, but the public availability of an exploit means that the risk is not negligible for local users. This vulnerability is not listed in the CISA KEV catalog, so no additional mitigation guidance is available from that source. Because execution is local, an attacker who can influence the ExecTool.Execute input can run arbitrary OS commands with the application’s privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Restrict local user privileges so that only trusted users can invoke Picobot’s ExecTool.Execute functionality.
  • Disable or remove the ExecTool.Execute feature if it is not required for business operations.
  • Continuously monitor Picobot logs for unexpected command‑execution patterns and investigate any anomalies promptly.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection
First Time appeared Louisho5
Louisho5 picobot
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:louisho5:picobot:*:*:*:*:*:*:*:*
Vendors & Products Louisho5
Louisho5 picobot
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 12:40 PM
Reserved
Jul 13, 2026, 9:12 PM

View source JSON

Updated
Jul 14, 2026, 12:40 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 6:17 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:00 AM

JSON