CVE-2026-112101 in pi-agent-dashboard
Summary
by MITRE • 10/19/2026
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in BlackBeltTechnology pi-agent-dashboard versions up through 0.8.0 represents a critical security flaw within the WebSocket Gateway component, specifically affecting an internal function responsible for handling current working directory arguments. This issue stems from insufficient validation of input parameters passed to the application during runtime operations involving file system interactions or path resolution mechanisms. When an attacker manipulates the cwd argument, they can induce an origin validation error that disrupts normal security checks designed to ensure requests originate from trusted sources. The core technical failure lies in the lack of rigorous sanitization and boundary checking for directory paths provided by external inputs, allowing malicious actors to bypass expected access controls or trigger state inconsistencies within the WebSocket connection handling logic.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately verify that user-supplied data conforms to expected formats and constraints before processing it. Furthermore, because the flaw involves manipulating execution context through path arguments which can potentially lead to unauthorized access or service disruption, it also relates closely to CWE-78 OS Command Injection if the cwd parameter is subsequently used in command-line operations without proper escaping. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving input validation bypasses and potentially privilege escalation depending on how the origin error impacts subsequent authentication or authorization checks within the dashboard interface.
The operational impact of this vulnerability is significant due to its remote exploitability. Since the WebSocket Gateway typically handles real-time communication between clients and servers, an attacker located remotely can send crafted requests that trigger the cwd manipulation flaw. This could result in denial of service conditions where legitimate users are unable to establish or maintain connections, or more severely, it may allow for unauthorized access if the origin validation failure prevents proper identity verification checks from executing correctly. The fact that this exploit has been publicly disclosed increases the risk landscape considerably, as automated scanning tools and malicious actors can readily leverage known proof-of-concept code to target unpatched instances across internet-facing deployments.
Mitigation strategies must prioritize immediate remediation through software updates. Upgrading BlackBeltTechnology pi-agent-dashboard to version 0.9.0 or later is the definitive solution, as this release incorporates patch identifier 48fd0bad5adfe76af9736599699d51a5f60019f6 which addresses the underlying input validation deficiencies in the WebSocket Gateway component. Organizations should verify their deployment environments for any instances running version 0.8.0 or earlier and schedule maintenance windows to apply this update promptly. In addition to upgrading, administrators should implement network-level controls such as Web Application Firewalls configured to detect anomalous path traversal patterns or malformed arguments in WebSocket frames, providing a layer of defense-in-depth while the upgrade process is completed. Regular security audits and penetration testing focused on input validation weaknesses are also recommended to identify similar flaws across other components within the application architecture.