Threats affecting pkg:github/foxweb/pico

CVE-2026-72574 is a host header injection vulnerability in picocms/Pico versions prior to 2.1.5. It allows an unauthenticated remote attacker to manipulate the origin of JavaScript and CSS assets loaded by the default theme by exploiting how the base URL is constructed from unvalidated HTTP headers when base_url is unset.

route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.