The vulnerability CVE-2026-15669 affects louisho5 picobot versions 0.1 and 0.2.0. It is an OS command injection issue in the ExecTool.Execute function of the exec Tool component, located in internal/agent/tools/exec.go. This vulnerability allows a local attacker with limited privileges to inject and execute arbitrary operating system commands. The issue was responsibly disclosed to the project but remains unaddressed, and no patch or official remediation has been published. The CVSS vector indicates low attack complexity, no user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow a local attacker to execute arbitrary OS commands, potentially leading to unauthorized actions on the affected system. The impact is limited by the requirement for local access and the low privileges needed, but it still poses a risk to system integrity and confidentiality. There is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's communications for updates or patches. Until a fix is released, restricting local access to trusted users and employing system-level controls to limit command execution privileges may help mitigate risk.