MEDIUM 5.3 NVD
CVE-2026-125367
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints.
References
- https://github.com/picosh/pico
- https://github.com/picosh/pico/blob/v4.1.2/pkg/apps/feeds/cron.go#L358
- https://github.com/picosh/pico/commit/48a85d6
- https://github.com/picosh/pico/issues/229
- https://www.vulncheck.com/advisories/pico-through-4.1.2-ssrf-in-feeds-service-via-run-ssh-
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-10 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.