MEDIUM
PicoClaw Web Launcher Management Plane restart command injection
Published Apr 25, 2026
6.9
MEDIUMCVSS 4.0
EPSS 4.66%
Description
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
- Vendor n/a Product PicoClaw Defaultn/a
- Version 0.2.0StatusaffectedConstraints-
- Version 0.2.1StatusaffectedConstraints-
- Version 0.2.2StatusaffectedConstraints-
- Version 0.2.3StatusaffectedConstraints-
- Version 0.2.4StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n/a | PicoClaw | n/a |
|
No data.
No Red Hat product state for this CVE.
github.com/sipeed/picoclaw
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sipeed/picoclaw | 0 | not fixed |
Remediation
No remediation recorded yet.
References (6)
- https://github.com/advisories/GHSA-6r3x-h84w-fhxx Advisory
- https://github.com/sipeed/picoclaw/issues/2307 issue-trackingExploitIssue TrackingMitigationVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6987
- https://vuldb.com/submit/796336 third-party-advisoryThird Party AdvisoryVDB Entry
- https://vuldb.com/vuln/359530 vdb-entryThird Party AdvisoryVDB Entry
- https://vuldb.com/vuln/359530/cti signaturepermissions-requiredPermissions RequiredVDB Entry
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-6r3x-h84w-fhxx | Advisory | |
| https://github.com/sipeed/picoclaw/issues/2307 | issue-trackingExploitIssue TrackingMitigationVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-6987 | ||
| https://vuldb.com/submit/796336 | third-party-advisoryThird Party AdvisoryVDB Entry | |
| https://vuldb.com/vuln/359530 | vdb-entryThird Party AdvisoryVDB Entry | |
| https://vuldb.com/vuln/359530/cti | signaturepermissions-requiredPermissions RequiredVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Apr 25, 2026
Updated Apr 27, 2026
Reserved Apr 24, 2026
Link CVE-2026-6987
CISA Vulnrichment
GHSA-6R3X-H84W-FHXX Updated Apr 27, 2026