Server-Side Request Forgery Vulnerability in Pico Product by Pico
CVE-2026-125367

5.3MEDIUM

Key Information:

Vendor

Picosh

Status
Pico
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125367?

Pico versions up to 4.1.2 exhibit a server-side request forgery (SSRF) vulnerability in the feeds service, allowing authenticated users to exploit the issue by making the server fetch arbitrary URLs. This is achieved through the execution of the run SSH command. Attackers can create malicious feeds that initiate requests to internal URLs, including loopback and cloud metadata endpoints, potentially compromising sensitive information.

Affected Version(s)

pico 0 <= 4.1.2

References

https://github.com/picosh/pico/issues/229
issue-tracking
https://github.com/picosh/pico
product
https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.