CVE-2026-15669: louisho5 picobot RCE Vulnerability

CVE-2026-15669 Overview

CVE-2026-15669 is an operating system command injection vulnerability [CWE-77] affecting louisho5 picobot versions up to 0.2.0. The flaw resides in the ExecTool.Execute function inside internal/agent/tools/exec.go, part of the exec Tool component. An attacker with local access and low privileges can manipulate input passed to this function to inject arbitrary operating system commands. A public exploit exists, increasing the likelihood of opportunistic abuse. The project maintainer was notified through a GitHub issue but has not responded, meaning no official patch is currently available.

Critical Impact
Local attackers with low privileges can execute arbitrary operating system commands through the picobot agent's exec Tool, and public exploit details are available while the project remains unpatched.

Affected Products

louisho5 picobot versions up to and including 0.2.0
Component: exec Tool (internal/agent/tools/exec.go)
Function: ExecTool.Execute

Discovery Timeline

2026-07-14 - CVE-2026-15669 published to the National Vulnerability Database
2026-07-14 - CVE-2026-15669 last modified in NVD

Technical Details for CVE-2026-15669

Vulnerability Analysis

The vulnerability is classified as an OS command injection weakness [CWE-77] in the picobot agent framework. The ExecTool.Execute function in internal/agent/tools/exec.go accepts input that is subsequently used to construct commands executed by the underlying operating system. Because the input is not adequately sanitized or restricted to a safe allowlist, an attacker can embed shell metacharacters or additional command sequences that the process runs with the privileges of the picobot agent.

Exploitation requires local access to the target system and low-level authenticated privileges. The attack complexity is low and no user interaction is required. Public exploit information has been released, and the project has not yet acknowledged the report.

Root Cause

The root cause is unsanitized input flowing into a command execution primitive within ExecTool.Execute. When the function passes attacker-controlled strings to a shell or command runner without argument separation, escaping, or validation, injected metacharacters change the semantics of the executed command. This is a canonical [CWE-77] pattern in Go tools that wrap os/exec behavior for agent tooling.

Attack Vector

An authenticated local attacker crafts input to the exec Tool such that the string passed to ExecTool.Execute contains shell control sequences or chained commands. When the tool processes the request, the injected payload runs alongside or in place of the intended command. Because the vulnerability is exposed through an agent tool interface, any local user or process that can supply input to the picobot agent can trigger execution. Public proof-of-concept material is available through the project's GitHub issues and the VulDB entry for CVE-2026-15669.

No verified exploit code is reproduced here. Refer to the upstream references for technical detail: GitHub Issue #42 and GitHub Issue #43.

Detection Methods for CVE-2026-15669

Indicators of Compromise

Unexpected child processes spawned by the picobot agent binary, particularly shell interpreters such as sh, bash, or cmd.exe.
Process command lines originating from picobot that contain shell metacharacters such as ;, &&, |, backticks, or $().
Outbound network connections initiated by processes whose parent is the picobot agent but which are not part of normal agent behavior.

Detection Strategies

Monitor process ancestry on hosts running picobot and alert when the agent process spawns interactive shells or system utilities such as curl, wget, nc, or powershell.
Baseline the expected command set invoked by the picobot exec Tool and flag deviations, including unexpected binaries or unusual argument patterns.
Ingest host telemetry into a centralized analytics pipeline and correlate picobot process events with subsequent file writes, privilege changes, or network egress.

Monitoring Recommendations

Enable command-line auditing on all systems running picobot to capture full argument strings for forensic review.
Track modifications to internal/agent/tools/exec.go and related binaries to detect tampering or unauthorized redeployment.
Review picobot logs for tool invocations containing untrusted or externally sourced input and cross-reference against known benign workflows.

How to Mitigate CVE-2026-15669

Immediate Actions Required

Restrict local access to systems running picobot 0.2.0 or earlier, and remove the agent from hosts where it is not strictly required.
Run picobot under a dedicated low-privilege account so that a successful injection cannot easily escalate to full system compromise.
Audit which local users and processes can submit input to the picobot agent's exec Tool and remove unnecessary access.

Patch Information

At the time of publication, no vendor patch is available. The maintainer of louisho5/picobot was notified through GitHub Issue #42 and GitHub Issue #43 but has not responded. Track the upstream picobot repository for a fixed release and verify any downstream forks in use.

Workarounds

Disable the exec Tool component in picobot deployments where it is not required for core functionality.
Wrap or replace ExecTool.Execute invocations with an allowlist of approved commands and arguments, rejecting any input containing shell metacharacters.
Isolate picobot instances inside containers or sandboxes with restricted filesystem, network, and syscall privileges to limit blast radius if injection succeeds.

bash

# Example: run picobot under a restricted user with a minimal PATH
useradd --system --no-create-home --shell /usr/sbin/nologin picobot
sudo -u picobot env PATH=/usr/local/picobot/bin /usr/local/picobot/bin/picobot