Quick answers
- Is CVE-2026-15669 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-15669 being exploited in the wild.
- How severe is CVE-2026-15669?
- Medium severity, with a CVSS score of 5.3, published 14 July 2026.
- Which products and versions are affected?
- Louisho5 Picobot <= 0.2.0.
- Is there a fix for CVE-2026-15669?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-15669 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-15669?
- Check whether you run Louisho5 Picobot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability exists in the `ExecTool.Execute` function within `internal/agent/tools/exec.go`. The component attempts to restrict command execution using a blacklist of dangerous programs and basic path validation; however, it only validates the first element of an input array. An attacker can bypass these checks by using shell wrappers like `sh -c` or `bash -lc` to execute arbitrary payloads. This allows for arbitrary command execution under the context of the Picobot process. The vulnerability is reachable via the default agent loop and has been demonstrated using a local OpenAI-compatible stub provider. As of the advisory date, no patch has been released by the maintainer.
Affected products
- louisho5 picobot <= 0.2.0
Timeline
- 2026-06-10: disclosed: Issue reported to the maintainer via GitHub issue #42
- 2026-07-14: advisory: CVE published by VulDB/NVD