CVE-2026-0898

Critical

Published: 23/03/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers automating Google Chrome and Microsoft Edge in versions 22.1 or R25. It does not affect Robot Runtime users. An attacker could create a malicious website, and the vulnerability may be exploited if a developer is tricked into visiting it during interrogation mode in Robot Studio.

Risk Assessment

The risk involves the possibility of writing malicious files on the developer's machine, potentially leading to compromise of the development environment or data theft.

Recommendation

It is recommended to update Pega Robot Studio to a patched version and to exercise caution when visiting unknown websites in interrogation mode.

Original NVD description (English source)

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.