CVE-2026-108890 Details
Description
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability in BlackBelt Technology's pi-agent-dashboard, affecting versions through 0.8.0, allows for unauthenticated cross-site WebSocket hijacking. This issue arises from the WebSocket upgrade handler, which only checks the TCP peer address for loopback, neglecting to validate the 'Origin' header. As a result, any website can initiate a WebSocket connection to the dashboard, bypassing authentication and origin checks. Once the connection is established, the server broadcasts a snapshot of all active sessions, including sensitive information such as working directories and session states. The vulnerability can be exploited by sending a 'create_terminal' command through the WebSocket, which spawns an interactive shell on the victim's machine. This flaw has been publicly disclosed and exploited, leading to remote code execution on the affected system.
Users are advised to update to version 0.9.0 or later, where this vulnerability has been fixed. The latest version can be downloaded from the BlackBelt Technology pi-agent-dashboard GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/drive/folders/1obmr5PquMxcl6fMe2HohWDPQCg5uLDBB?usp=drive_link | [email protected] | |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/ | [email protected] | Vendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/commit/48fd0bad5adfe76af9736599699d51a5f60019f6 | [email protected] | Source CodeVendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/issues/625 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/pull/636 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-108890 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/973084 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416682 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416682/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BlackBeltTechnology pi-agent-dashboard | <= 0.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |