# CVE-2026-36045: Sipeed picoclaw OS command injection in ExecTool

Source: https://junglewise.ai/threats/cve-2026-36045-sipeed-picoclaw-os-command-injection-in-exectool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-36045 · Severity: high · CVSS 7.3 · Published 2026-05-27

Sipeed picoclaw is an AI agent framework used to automate tasks on IoT and embedded devices. A security flaw in its command execution component allows attackers to bypass safety filters and run unauthorized system commands. This could lead to full device takeover, data theft, or physical hardware manipulation on connected embedded systems.

Technologies: [Sipeed PicoClaw](https://junglewise.ai/threats/technologies/picoclaw). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sipeed](https://junglewise.ai/threats/vendors/sipeed).

## Quick answers

**Is CVE-2026-36045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36045 being exploited in the wild.

**How severe is CVE-2026-36045?** High severity, with a CVSS score of 7.3, published 27 May 2026.

**Which products and versions are affected?** github.com/sipeed/picoclaw (Go) <= 0.1.2, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.1.2; Sipeed PicoClaw <= 0.1.2, <=v0.1.2.

**Is there a fix for CVE-2026-36045?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-36045 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-36045?** Check whether you run github.com/sipeed/picoclaw (Go) or Sipeed PicoClaw at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in picoclaw <= v0.1.2 within the ExecTool component (pkg/tools/shell.go). The guardCommand() function utilizes a denylist of only eight regular expressions intended to block destructive commands like 'rm -rf' or 'format'. However, the list fails to account for shell invocations (e.g., bash, sh), pipes, scripting languages (Python, Perl), or privilege escalation commands (sudo). A remote attacker interacting with the AI agent via supported interfaces (Telegram, Discord, etc.) can provide crafted input to execute arbitrary shell commands. On embedded targets like the Sipeed LicheeRV Nano, this may grant root access and control over hardware interfaces like I2C and SPI. No patched version is currently available.

## Affected products

- Sipeed picoclaw <= 0.1.2

## Identifiers

- CVE-2026-36045
- GHSA-cv2p-68f4-f4pw
- GO-2026-5867

## Timeline

- 2025-02-17: other: Vulnerable version v0.1.2 released
- 2026-04-13: disclosed: Vulnerability discovered and documented in Gist
- 2026-05-27: advisory: GitHub Advisory and CVE published

## References

- [https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68](https://gist.github.com/NucleiAv/41899be6266a9813840301577792ed68)
- [https://github.com/sipeed/picoclaw/releases/tag/v0.1.2](https://github.com/sipeed/picoclaw/releases/tag/v0.1.2)
- [https://github.com/sipeed/picoclaw/commit/01d694b9985a66c3d7119fc9f74ce8ed4f0f21b5](https://github.com/sipeed/picoclaw/commit/01d694b9985a66c3d7119fc9f74ce8ed4f0f21b5)

## Related threats

- [Sipeed PicoClaw authentication bypass in First Run Setup](https://junglewise.ai/threats/cve-2026-16198-sipeed-picoclaw-authentication-bypass-in-first-run-setup)
- [Sipeed PicoClaw missing authorization in Feishu Group Message Handler](https://junglewise.ai/threats/cve-2026-16197-sipeed-picoclaw-missing-authorization-in-feishu-group-message)
- [Sipeed PicoClaw SSRF in web_fetch via special-use IPv4 bypass](https://junglewise.ai/threats/cve-2026-16196-sipeed-picoclaw-ssrf-in-web-fetch-via-special-use-ipv4-bypass)
- [Sipeed PicoClaw incorrect authorization in WeCom Group Message Handler](https://junglewise.ai/threats/cve-2026-16195-sipeed-picoclaw-incorrect-authorization-in-wecom-group-message)
- [Sipeed PicoClaw untrusted functionality inclusion in NewContextBuilder](https://junglewise.ai/threats/cve-2026-16085-sipeed-picoclaw-untrusted-functionality-inclusion-in)