CVE-2026-112101: BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BlackBeltTechnology/pi-agent-dashboardto a version that resolves this vulnerability.Fixed in 0.9.0Patch 48fd0bad5adfe76af9736599699d51a5f60019f6
Event History
Frequently Asked Questions
Which versions are affected and what version fixes the issue?
BlackBeltTechnology pi-agent-dashboard versions up to and including 0.8.0 are affected. Upgrading to version 0.9.0 fixes the vulnerability; the associated patch is 48fd0bad5adfe76af9736599699d51a5f60019f6.
Can this be exploited remotely, and does an attacker need prior access?
The issue can be exploited remotely. The provided data indicates no privileges are required, but exploitation requires user interaction.
What component and input are involved in exploitation?
The affected component is the WebSocket Gateway. Exploitation involves manipulating the cwd argument, resulting in an origin-validation error.
How urgent is remediation?
The vulnerability is rated medium severity with a CVSS score of 4.3. Public exploit disclosure is reported, so affected deployments should be upgraded to 0.9.0.