pi-mono vulnerabilities

In pi-mono up to version 0.58.4, the pi-mom Slack Bot component in packages/mom/src/slack.ts has an authentication bypass vulnerability via an alternate channel. The attack can be executed remotely and the exploit is public.

pi-mono up to 0.58.4 has a code injection vulnerability in the discoverAndLoadExtensions function in loader.ts. Remote exploitation is possible and the exploit is public.

In badlogic pi-mono 0.58.4, a cross-site scripting (XSS) vulnerability exists in packages/web-ui/src/tools/artifacts/SvgArtifact.ts in the SVG Artifact Handler component. Remote exploitation is possible and the exploit is public.