PT-2026-60924 · Sipeed · Picoclaw

Eric-I · CVE-2026-16082 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sipeed PicoClaw versions prior to 0.3.0

Description A time-of-check time-of-use (TOCTOU) issue exists in the ExecTool.executeRun() function within the pkg/agent/pipeline execute.go file. This occurs when the cwe argument is manipulated, allowing a local attacker to exploit the race condition between the time a condition is checked and the time it is used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-367

CWE-362

Related Identifiers

CVE-2026-16082

Affected Products

Picoclaw

References · 8

• 🔥 https://github.com/sipeed/picoclaw/issues/3081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16082 · Security Note
• https://twitter.com/VulmonFeeds/status/2078438497354973245 · Twitter Post
• https://vuldb.com/cve/CVE-2026-16082 · Note
• https://vuldb.com/vuln/379794/cti · Note
• https://github.com/sipeed/picoclaw · Note
• https://vuldb.com/submit/852944 · Note
• https://vuldb.com/vuln/379794 · Note