Executive brief
Sipeed PicoClaw is an AI assistant framework designed for high efficiency on low-power hardware. A security flaw in its web-fetching component allows an attacker to bypass safety restrictions and force the server to make unauthorized requests to internal network addresses. This could lead to the exposure of sensitive internal data or unauthorized access to private services that are not intended to be reachable from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `web_fetch` component of Sipeed PicoClaw up to version 0.2.9. The root cause is an incomplete IP address classifier in the `isPrivateOrRestrictedIP` function within `pkg/tools/integration/web.go`. While the function attempts to block RFC 1918, loopback, and CGNAT ranges, it fails to include the special-use IPv4 benchmark range `198.18.0.0/15`. A remote attacker with the ability to provide input to the `web_fetch` tool can exploit this omission to reach internal network destinations. A patch has been released in commit `2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405` which adds the missing range to the blocklist.
Affected products
- Sipeed PicoClaw up to 0.2.9
Timeline
- 2026-07-18: disclosed
- 2026-07-18: advisory
- 2026-07-18: patched: Patch 2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405
References
- https://github.com/sipeed/picoclaw/
- https://github.com/sipeed/picoclaw/commit/2efbe5d560e7ed9bc5209c203dc4aa6ecdbc7405
- https://github.com/sipeed/picoclaw/issues/3077
- https://github.com/sipeed/picoclaw/pull/3085
- https://vuldb.com/cve/CVE-2026-16196
- https://vuldb.com/submit/852963
- https://vuldb.com/vuln/380012