Executive brief
Sipeed PicoClaw, an AI assistant automation tool, contains a security flaw that allows attackers to bypass network restrictions. By providing specially crafted web addresses, an attacker can force the software to connect to internal servers or local services that are normally protected from outside access. This could lead to the exposure of sensitive internal data or unauthorized access to administrative interfaces within the organization's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_fetch` function within `pkg/tools/integration/web.go` of Sipeed PicoClaw. The application's IP filtering logic, specifically the `isPrivateOrRestrictedIP` function, fails to account for RFC 5214 ISATAP IPv6 literals that embed private or loopback IPv4 addresses (e.g., using the `:5efe:` identifier). An unauthenticated remote attacker can provide a crafted URL that bypasses preflight and connect-time security checks, allowing them to probe or interact with internal network resources. The issue has been addressed in a patch (commit c15aac2) which implements an SSRF guard for ISATAP literals.
Affected products
- Sipeed PicoClaw <= 0.2.9
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory
- 2026-07-18: patched: Patch commit c15aac21fe05ee103a470e1104bc891754e83392
References
- https://github.com/sipeed/picoclaw/
- https://github.com/sipeed/picoclaw/commit/c15aac21fe05ee103a470e1104bc891754e83392
- https://github.com/sipeed/picoclaw/issues/3074
- https://github.com/sipeed/picoclaw/pull/3143
- https://vuldb.com/cve/CVE-2026-16084
- https://vuldb.com/submit/852946
- https://vuldb.com/vuln/379796