CVE-2026-16085 Overview
CVE-2026-16085 affects Sipeed PicoClaw versions up to 0.2.9. The vulnerability resides in the NewContextBuilder function within pkg/agent/context.go. The flaw allows inclusion of functionality from an untrusted control sphere [CWE-829], meaning the agent context can load or execute components that are not properly validated. Exploitation requires local access with low privileges and no user interaction. The exploit has been publicly disclosed, but the maintainers closed the associated GitHub issue automatically with a "not planned" label, indicating no vendor fix is currently expected.
Critical Impact
Local attackers with low-privileged access can influence the PicoClaw agent context to include untrusted functionality, producing limited confidentiality, integrity, and availability impact on the affected host.
Affected Products
- Sipeed PicoClaw versions up to and including 0.2.9
- Component: pkg/agent/context.go
- Function: NewContextBuilder
Discovery Timeline
- 2026-07-18 - CVE-2026-16085 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16085
Vulnerability Analysis
The vulnerability is categorized under [CWE-829]: Inclusion of Functionality from Untrusted Control Sphere. Within PicoClaw, the NewContextBuilder routine assembles the runtime context used by the agent. When this builder pulls in code, configuration, or module references from a source that the application does not fully control, an attacker positioned locally can influence what functionality gets loaded. The result is that untrusted logic can execute within the trust boundary of the agent process.
The issue is scoped to local exploitation. An attacker must already possess some level of access on the host running PicoClaw. Once positioned, the attacker can manipulate the inputs consumed by NewContextBuilder to introduce untrusted components into the agent's execution context.
Root Cause
The root cause is insufficient validation of the sources feeding into NewContextBuilder. The function trusts inputs that originate outside the application's defined control sphere. Because the agent context governs downstream behavior, any untrusted inclusion propagates into subsequent operations. See the GitHub Project Repository and the GitHub Issue Tracker for the disclosure discussion.
Attack Vector
The attack vector is local. An authenticated user on the host manipulates the inputs referenced by NewContextBuilder in pkg/agent/context.go so that untrusted functionality is included into the agent context. No user interaction beyond the attacker's own activity is required. Additional analysis is available at VulDB CVE-2026-16085 and VulDB Vulnerability #379797.
No verified proof-of-concept code is available. Refer to the vendor repository and VulDB entries for technical details.
Detection Methods for CVE-2026-16085
Indicators of Compromise
- Unexpected modifications to files, environment variables, or configuration paths consumed by the PicoClaw agent during context construction.
- Unusual child processes or module loads spawned by the PicoClaw agent process after initialization.
- New or altered files referenced by pkg/agent/context.go that originate from non-administrative user directories.
Detection Strategies
- Monitor local filesystem access patterns of the PicoClaw agent binary, focusing on reads from user-writable locations during startup.
- Baseline the set of modules and resources legitimately loaded by NewContextBuilder and alert on deviations.
- Correlate local user activity with PicoClaw agent restarts or context rebuild events to identify attempts to influence context inputs.
Monitoring Recommendations
- Enable audit logging on directories and files consumed by the PicoClaw agent to capture write events by non-privileged users.
- Track process lineage for the PicoClaw agent to detect unexpected execution flows resulting from injected functionality.
- Retain host telemetry sufficient to reconstruct what inputs were present at each agent context initialization.
How to Mitigate CVE-2026-16085
Immediate Actions Required
- Restrict local access to systems running Sipeed PicoClaw 0.2.9 or earlier to trusted users only.
- Apply strict filesystem permissions to any configuration, module, or resource path referenced by pkg/agent/context.go.
- Inventory hosts running PicoClaw and evaluate whether continued deployment is justified given the vendor's "not planned" status.
Patch Information
No official patch is currently available. The GitHub issue tracking this vulnerability was closed automatically with the label "not planned" by a bot, indicating that the maintainers have not committed to a fix. Users should monitor the project repository for future updates and plan compensating controls in the interim.
Workarounds
- Run the PicoClaw agent under a dedicated low-privilege account isolated from other user data.
- Place PicoClaw configuration and module directories on filesystems where only administrators have write access.
- Consider containerizing or sandboxing the agent to constrain the impact of untrusted functionality inclusion.
- Remove PicoClaw from production hosts where local multi-user access cannot be tightly controlled.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
