Pico through 4.1.2 SSRF in Feeds Service via run SSH Command

Advisories

Pico through 4.1.2 SSRF in Feeds Service via run SSH Command

Severity: medium
Date: 11/9/2026
Affecting: pico <= 4.1.2
CVE: CVE-2026-125367
CWE: CWE-918 Server-Side Request Forgery (SSRF)
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References: GitHub Issue #229
https://github.com/picosh/pico
https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
https://github.com/picosh/pico/commit/48a85d6
Credit: George Chen
Description: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo