Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-125367

Pico through 4.1.2 SSRF in Feeds Service via run SSH Command

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

picosh pico

Default version status: unaffected

  • 0 to ≤ 4.1.2affected
pkg:golang/github.com/picosh/pico

References