# CVE-2026-16082: Sipeed PicoClaw TOCTOU race condition in ExecTool.executeRun

Source: https://junglewise.ai/threats/cve-2026-16082-sipeed-picoclaw-toctou-race-condition-in-exectool-executerun  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16082 · Severity: medium · CVSS 5.3 · Published 2026-07-18

Sipeed PicoClaw is an AI assistant framework written in Go. A security flaw allows a local attacker to trick the system into executing commands in a different directory than the one approved by a human or automated policy. This could lead to unauthorized file access or modification within the workspace, bypassing the safety checks intended to restrict where commands can run.

Technologies: [Sipeed PicoClaw](https://junglewise.ai/threats/technologies/picoclaw). Vendors: [Sipeed](https://junglewise.ai/threats/vendors/sipeed).

## Quick answers

**Is CVE-2026-16082 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16082 being exploited in the wild.

**How severe is CVE-2026-16082?** Medium severity, with a CVSS score of 5.3, published 18 July 2026.

**Which products and versions are affected?** Sipeed PicoClaw <= 0.2.9.

**Is there a fix for CVE-2026-16082?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16082 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-16082?** Check whether you run Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the ExecTool.executeRun function within pkg/agent/pipeline_execute.go. The vulnerability occurs because the approval hook inspects the working directory (cwd) argument before the tool re-resolves symlinks immediately prior to process execution in pkg/tools/shell.go. A local attacker can exploit this window by swapping a workspace-local symlink after approval is granted but before execution begins. This causes the command to run in an 'evil' directory while the approval mechanism believes it is running in a 'safe' one. While the attack is restricted to the workspace, it breaks the integrity of the approval flow for relative file operations and directory-sensitive commands. As of the advisory date, no patch is available and the issue was marked as 'not planned' by the maintainers.

## Affected products

- Sipeed PicoClaw <= 0.2.9

## Timeline

- 2026-07-18: disclosed
- 2026-07-18: advisory

## References

- [https://github.com/sipeed/picoclaw/](https://github.com/sipeed/picoclaw/)
- [https://github.com/sipeed/picoclaw/issues/3081](https://github.com/sipeed/picoclaw/issues/3081)
- [https://vuldb.com/cve/CVE-2026-16082](https://vuldb.com/cve/CVE-2026-16082)
- [https://vuldb.com/submit/852944](https://vuldb.com/submit/852944)
- [https://vuldb.com/vuln/379794](https://vuldb.com/vuln/379794)
- [https://vuldb.com/vuln/379794/cti](https://vuldb.com/vuln/379794/cti)

## Related threats

- [Sipeed PicoClaw authentication bypass in First Run Setup](https://junglewise.ai/threats/cve-2026-16198-sipeed-picoclaw-authentication-bypass-in-first-run-setup)
- [Sipeed PicoClaw missing authorization in Feishu Group Message Handler](https://junglewise.ai/threats/cve-2026-16197-sipeed-picoclaw-missing-authorization-in-feishu-group-message)
- [Sipeed PicoClaw SSRF in web_fetch via special-use IPv4 bypass](https://junglewise.ai/threats/cve-2026-16196-sipeed-picoclaw-ssrf-in-web-fetch-via-special-use-ipv4-bypass)
- [Sipeed PicoClaw incorrect authorization in WeCom Group Message Handler](https://junglewise.ai/threats/cve-2026-16195-sipeed-picoclaw-incorrect-authorization-in-wecom-group-message)
- [Sipeed PicoClaw untrusted functionality inclusion in NewContextBuilder](https://junglewise.ai/threats/cve-2026-16085-sipeed-picoclaw-untrusted-functionality-inclusion-in)