GO-2026-5867 picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw

picoclaw is vulnerable to OS command injection via the ExecTool component in github.com/sipeed/picoclaw...

CVE-2026-36045

picoclaw =v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component pkg/tools/shell.go. The guardCommand function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the denylist is incomplete...