CVE-2026-112101

MediumCVSS 4.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Summary

A vulnerability was determined in pi-agent-dashboard up to 0.8.0 in the WebSocket Gateway component, where manipulating the cwd argument leads to an origin validation error. The attack can be executed remotely and the exploit has been publicly disclosed. Upgrading to version 0.9.0 (patch 48fd0bad5adfe76af9736599699d51a5f60019f6) fixes the issue.

Risk Assessment

A remote attacker can use the public exploit to bypass origin validation and gain unauthorized access to WebSocket functionality. This may lead to confidentiality or integrity breaches in the dashboard.

Recommendation

Upgrade pi-agent-dashboard to version 0.9.0 or apply the referenced patch. Until then, restrict network access to the WebSocket Gateway.

Other vulnerabilities in pi-agent-dashboard

CVE-2026-108890Medium
A vulnerability was found in pi-agent-dashboard up to version 0.8.0. The issue affects the terminalManager.spawn function in terminal-handler.ts, where manipulation of the cwd argument leads to improper authorization. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS