CVE-2026-112101 Details
Description
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
A vulnerability in BlackBelt Technology's pi-agent-dashboard version 0.8.0 and prior has been identified, allowing for cross-site WebSocket hijacking and remote code execution. The issue arises in the WebSocket gateway component, where the server fails to properly validate the 'Origin' header of incoming WebSocket upgrade requests. This lack of validation allows any web page to initiate a WebSocket connection to the dashboard server, bypassing authentication and origin checks. Once connected, the attacker can access sensitive session information and execute commands on the victim's machine via an interactive shell.
Users are advised to upgrade to version 0.9.0, where this vulnerability has been fixed. The update includes a proper origin validation mechanism for WebSocket upgrades and restores the integrity of the 'sessions_snapshot' data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/ | [email protected] | Vendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/commit/48fd0bad5adfe76af9736599699d51a5f60019f6 | [email protected] | Source CodeVendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/issues/625 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/pull/636 | [email protected] | Issue TrackingVendor |
| https://github.com/BlackBeltTechnology/pi-agent-dashboard/releases/tag/v0.9.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-112101 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1012811 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421967 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421967/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BlackBeltTechnology pi-agent-dashboard | <= 0.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |