Executive brief
Sipeed PicoClaw, an AI assistant automation tool, contains a security flaw in its web fetching component. When the software is configured to use a network proxy, an attacker can trick the assistant into accessing internal company websites or sensitive local data that should be restricted. This could lead to the exposure of private internal information or unauthorized access to internal services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the WebFetchTool.Execute function within pkg/tools/integration/web.go. The 'Guarded Web Fetch Flow' fails to properly validate destination URLs when the PicoClaw process is started with environment proxy variables (e.g., HTTP_PROXY) and the internal 'tools.web.proxy' setting is empty. While the tool implements a safe dialer to block private IP ranges, it allow-lists the proxy as a 'first hop.' In proxy mode, the Go HTTP client sends the full attacker-controlled URL to the proxy, which then performs the connection to the internal target on behalf of the application, effectively bypassing the SSRF protections. Attackers can exploit this via prompt injection or untrusted task input to retrieve content from internal-only resources.
Affected products
- Sipeed PicoClaw up to 0.2.9
Timeline
- 2026-07-10: advisory: NVD publication date
- 2026-06-05: disclosed: Date mentioned in PoC evidence logs