This vulnerability affects Sipeed PicoClaw up to version 0.2.9 in the ExecTool.executeRun function. It involves a time-of-check to time-of-use race condition triggered by manipulation of the 'cwe' argument. The attack vector is local, requiring the attacker to have local access to the system. The vulnerability has been publicly disclosed with an available exploit, but no official fix or patch has been provided by the vendor. The GitHub issue tracking this vulnerability was closed automatically with a 'not planned' label, indicating no planned remediation.

Successful exploitation of this vulnerability can lead to a race condition that may allow an attacker with local access to manipulate the execution flow or state of the affected function. The CVSS score of 4.8 indicates a medium impact, with low attack complexity and no user interaction required. However, the impact is limited by the need for local access and privileges.

No official patch or remediation is currently available for this vulnerability. The vendor has not planned a fix as indicated by the closure of the related GitHub issue. Users should restrict local access to trusted users only and monitor for any suspicious activity related to the affected function. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.