Technical impact
An attacker can execute arbitrary shell commands through picoclaw's ExecTool component because the command filtering only blocks a few patterns and leaves many injection vectors open. This flaw is classified as OS command injection, allowing an attacker to manipulate the host system or exfiltrate data. The vulnerability is a direct result of incomplete input validation when launching system commands.
Affected Systems
The affected product is picoclaw, specifically versions 0.1.2 and earlier. No vendor information is recorded, but the entire software package is vulnerable.
Risk and Exploitability
The CVSS score for this issue is 7.3, and the EPSS rating is 1%, while it is not listed in the CISA KEV catalog, suggesting that exploitation is not widely observed. Based on the description, it is inferred that the attacker must have access to a mechanism that can invoke the ExecTool interface, such as a local service or API endpoint, to be able to run arbitrary commands with the privileges of the picoclaw process. The incomplete denylist means that the flaw is highly exploitable once the entry point is reachable.
Github GHSA