A server-side request forgery vulnerability was found in picobot up to 0.2.0. The vulnerability affects the WebTool.Execute function in internal/agent/tools/web.go. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. This issue has been disclosed publicly, and although the project was informed early, no response has been received yet. The vulner [truncated]
A weakness has been identified in louisho5 picobot up to 0.2.0, impacting the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. This vulnerability allows for link following when a manipulation is executed, potentially leading to security issues. The attack can be launched remotely. Users and administrators should be aware of this weakness and [truncated]
