What is GHSA-6r3x-h84w-fhxx?

GHSA-6r3x-h84w-fhxx is a security advisory published by GitHub Security Advisories with Medium severity. PicoClaw has an Injection issue in its Web Launcher Management Plane component

Which CVE IDs does GHSA-6r3x-h84w-fhxx cover?

GHSA-6r3x-h84w-fhxx covers the following CVE IDs: CVE-2026-6987. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6r3x-h84w-fhxx?

GHSA-6r3x-h84w-fhxx has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6r3x-h84w-fhxx?

GHSA-6r3x-h84w-fhxx affects 1 product, including: go/github.com/sipeed/picoclaw:\u003c= 0.2.4.

GHSA-6r3x-h84w-fhxxMediumCVSS 7.3

PicoClaw has an Injection issue in its Web Launcher Management Plane component

Vendor

GitHub Security Advisories

Published

April 25, 2026

Last Modified

May 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-6987 →

📋 Description

A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

🎯 Affected products1

go/github.com/sipeed/picoclaw:<= 0.2.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-6987
https://github.com/sipeed/picoclaw/issues/2307
https://vuldb.com/submit/796336
https://vuldb.com/vuln/359530
https://vuldb.com/vuln/359530/cti
https://github.com/advisories/GHSA-6r3x-h84w-fhxx