A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
References
| Link | Resource |
|---|---|
| https://github.com/sipeed/picoclaw/issues/2307 | Exploit Mitigation Vendor Advisory Issue Tracking |
| https://vuldb.com/submit/796336 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/359530 | Third Party Advisory VDB Entry |
| https://vuldb.com/vuln/359530/cti | Permissions Required VDB Entry |
Configurations
History
01 May 2026, 20:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sipeed
Sipeed picoclaw |
|
| CPE | cpe:2.3:a:sipeed:picoclaw:*:*:*:*:*:go:*:* | |
| References | () https://github.com/sipeed/picoclaw/issues/2307 - Exploit, Mitigation, Vendor Advisory, Issue Tracking | |
| References | () https://vuldb.com/submit/796336 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/359530 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/vuln/359530/cti - Permissions Required, VDB Entry |
25 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-25 17:16
Updated : 2026-05-01 20:24
NVD link : CVE-2026-6987
Mitre link : CVE-2026-6987
CVE.ORG link : CVE-2026-6987
JSON object : View
Products Affected
sipeed
- picoclaw