Executive brief
Sipeed PicoClaw is an AI assistant framework designed for low-power hardware. A security flaw allows regular chat users to trigger a full reload of the system's configuration by sending a specific command through the chat interface. While administrative changes usually require a secure management token, this bypass allows non-administrative users to force the system to restart its services, potentially causing temporary service interruptions or operational instability.
Technical details
A missing authorization check in the PicoClaw command execution pipeline allows users authenticated to the Pico WebSocket channel to invoke administrative actions. Specifically, the `rt.ReloadConfig` function in `pkg/channels/pico/pico.go` can be triggered by sending a `/reload` command within a standard `message.send` payload. While the dedicated HTTP management endpoint `/reload` correctly enforces bearer-token authorization, the chat-based command path fails to verify if the sender has administrative privileges. An attacker with a valid Pico chat token can remotely force a configuration reload, leading to a service restart and potential availability issues. The vulnerability is present in versions up to 0.2.9.
Affected products
- Sipeed PicoClaw up to 0.2.9
Timeline
- 2026-07-10: advisory: NVD publication date
- 2026-07-10: disclosed: Public exploit availability reported