Time-of-check Time-of-use Vulnerability in Sipeed PicoClaw by Sipeed
CVE-2026-16082

4.8MEDIUM

Key Information:

Vendor: Sipeed
Status: Picoclaw
Vendor: CVE Published:; 18 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16082?

A vulnerability exists in the Sipeed PicoClaw up to version 0.2.9, specifically within the ExecTool.executeRun function in the file pkg/agent/pipeline_execute.go. This flaw arises from improper handling of the argument 'cwe' which can lead to a time-of-check time-of-use condition. The exploit must be executed locally, and available public exploits may pose a risk to users. Notably, a related issue on GitHub was closed automatically with the label 'not planned', indicating a lack of forthcoming resolution or patch.

Affected Version(s)

PicoClaw 0.2.0

PicoClaw 0.2.1

PicoClaw 0.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16082 - Proof of Concept