CVE-2026-125367

CVSS 5.4 (medium) · published 2026-11-10

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

Weakness: CWE-918

Source: NVD CVE-2026-125367

References

• https://github.com/picosh/pico
• https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
• https://github.com/picosh/pico/commit/48a85d6
• https://github.com/picosh/pico/issues/229
• https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-command

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.