Threats affecting pkg:golang/pico

CVE-2026-125367 is a server-side request forgery (SSRF) vulnerability in the pico software up to version 4.1.2. It affects the feeds service, allowing signed-up users to make the server fetch arbitrary URLs via the run SSH command. This can be exploited by uploading a feeds digest post listing internal URLs, triggering immediate fetching through Fetcher.ParseURL, potentially accessing loopback, private network (RFC1918), and cloud metadata endpoints.