CVE-2026-125367

5.4 MEDIUMpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-918

Public exploit & PoC references

https://github.com/picosh/pico
https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
https://github.com/picosh/pico/commit/48a85d6
https://github.com/picosh/pico/issues/229

All references

https://github.com/picosh/pico
https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
https://github.com/picosh/pico/commit/48a85d6
https://github.com/picosh/pico/issues/229
https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2020-37278PoC
HIGHCVE-2023-54402PoC
MEDIUMCVE-2024-34319
HIGHCVE-2025-14260
UNSCOREDCVE-2026-0311
LOWCVE-2026-100104
MEDIUMCVE-2026-100251
MEDIUMCVE-2026-100257

Related by shared AI tags and CWE weakness class. Browse the full archive.