GHSA-w9q5-ph3c-c66xMediumCVSS 5.4
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that...
🔗 CVE IDs covered (1)
📋 Description
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125367
- https://github.com/picosh/pico/issues/229
- https://github.com/picosh/pico/commit/48a85d6
- https://github.com/picosh/pico
- https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
- https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command
- https://github.com/advisories/GHSA-w9q5-ph3c-c66x