Executive brief
Sipeed picoclaw is an AI agent framework used to automate tasks on IoT and embedded devices. A security flaw in its command execution component allows attackers to bypass safety filters and run unauthorized system commands. This could lead to full device takeover, data theft, or physical hardware manipulation on connected embedded systems.
Technical details
An OS command injection vulnerability exists in picoclaw <= v0.1.2 within the ExecTool component (pkg/tools/shell.go). The guardCommand() function utilizes a denylist of only eight regular expressions intended to block destructive commands like 'rm -rf' or 'format'. However, the list fails to account for shell invocations (e.g., bash, sh), pipes, scripting languages (Python, Perl), or privilege escalation commands (sudo). A remote attacker interacting with the AI agent via supported interfaces (Telegram, Discord, etc.) can provide crafted input to execute arbitrary shell commands. On embedded targets like the Sipeed LicheeRV Nano, this may grant root access and control over hardware interfaces like I2C and SPI. No patched version is currently available.
Affected products
- Sipeed picoclaw <= 0.1.2
Timeline
- 2025-02-17: other: Vulnerable version v0.1.2 released
- 2026-04-13: disclosed: Vulnerability discovered and documented in Gist
- 2026-05-27: advisory: GitHub Advisory and CVE published