CVE-2026-15629: louisho5 picobot RCE Vulnerability

CVE-2026-15629 Overview

CVE-2026-15629 affects louisho5 picobot versions up to 0.2.0. The flaw resides in the CreateSkill and GetSkill functions within internal/agent/tools/filesystem.go, part of the Workspace Handler component. The weakness enables link following [CWE-59], allowing an attacker to manipulate symbolic links to influence file operations performed by the application. The issue is exploitable remotely with low-privileged access. A public exploit exists, and the project was notified through an issue report but has not responded.

Critical Impact
Remote attackers with low privileges can leverage symbolic link manipulation in the Workspace Handler to affect confidentiality, integrity, and availability of files accessed by picobot.

Affected Products

louisho5 picobot 0.1.x
louisho5 picobot 0.2.0
Workspace Handler component (internal/agent/tools/filesystem.go)

Discovery Timeline

2026-07-14 - CVE-2026-15629 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15629

Vulnerability Analysis

The vulnerability is classified as a link following weakness [CWE-59] in the picobot agent's filesystem tooling. The CreateSkill and GetSkill functions in internal/agent/tools/filesystem.go handle skill files within a designated workspace directory. When these functions read or write to paths supplied through the workspace interface, they do not adequately verify whether a path component is a symbolic link pointing outside the intended workspace boundary.

An attacker who can place or influence symbolic links within the workspace can redirect file operations to arbitrary locations on the host. This enables reading files the agent should not access or writing content to paths the agent should not modify. The attack is network-reachable and requires low privileges but no user interaction.

Root Cause

The root cause is insufficient path validation before performing filesystem operations. The affected Go functions resolve caller-supplied paths without confirming that the final target remains inside the workspace root after symlink resolution. This omission is the defining characteristic of a link following vulnerability.

Attack Vector

Exploitation involves placing a symbolic link within the workspace that references a sensitive file or directory outside it. When CreateSkill writes to that link, the write is redirected to the linked target. When GetSkill reads from it, the caller receives data from the linked target. A public proof-of-concept has been referenced through the project's issue tracker. See the GitHub Issue Tracker for reported details.

No verified exploit code is reproduced here. Refer to the VulDB CVE Details for further technical context.

Detection Methods for CVE-2026-15629

Indicators of Compromise

Unexpected symbolic links inside the picobot workspace directory that point outside the workspace root.
Filesystem access events from the picobot process targeting paths outside its expected working directory.
Modifications to sensitive files timestamped alongside CreateSkill invocations.

Detection Strategies

Audit the workspace directory for symlinks whose resolved targets fall outside the workspace root.
Enable Go application logging around CreateSkill and GetSkill to record fully resolved paths before I/O.
Correlate picobot process file access with expected skill file locations and alert on deviations.

Monitoring Recommendations

Monitor the host user account running picobot for reads or writes to files outside its designated workspace.
Track creation of symbolic links inside the workspace using filesystem auditing tools such as auditd on Linux.
Review picobot request logs for skill names that contain unusual path characters or reference existing on-disk artifacts.

How to Mitigate CVE-2026-15629

Immediate Actions Required

Restrict network exposure of picobot to trusted callers until a fix is available.
Run picobot under a dedicated low-privilege user account with no access to sensitive host files.
Remove any pre-existing symbolic links from the workspace directory and prevent their creation.

Patch Information

As of the CVE publication date, the project has not responded to the disclosure and no official patch is available. Monitor the GitHub Project Repository and the GitHub Issue Tracker for updates. Users should pin to a known configuration and evaluate forks or local patches that validate resolved paths against the workspace root.

Workarounds

Deploy picobot inside a container or chroot with the workspace as the only writable mount point.
Apply mandatory access controls such as AppArmor or SELinux to confine picobot filesystem access.
Add a wrapper or reverse proxy that rejects skill names containing path separators or traversal sequences.

bash

# Example: run picobot under a restricted user with a bind-mounted workspace
sudo useradd -r -s /usr/sbin/nologin picobot
sudo install -d -o picobot -g picobot -m 700 /var/lib/picobot/workspace

# Prevent symlink creation inside the workspace via mount options where supported
sudo mount --bind /var/lib/picobot/workspace /var/lib/picobot/workspace
sudo mount -o remount,nosuid,nodev,noexec /var/lib/picobot/workspace

# Launch picobot as the restricted user
sudo -u picobot /usr/local/bin/picobot --workspace /var/lib/picobot/workspace