BlackBeltTechnology pi-agent-dashboard up to 0.8.0 Terminal terminal-handler.ts terminalManager.spawn cwd improper authorization

Summaryinfo

A vulnerability classified as critical was found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. This affects the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd results in improper authorization. This vulnerability is reported as CVE-2026-108890. The attack can be launched remotely. Moreover, an exploit is present. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Detailsinfo

A vulnerability classified as critical has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-108890. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details and a public exploit are known. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

The exploit is shared for download at drive.google.com. It is declared as proof-of-concept. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Applying the patch 48fd0bad5adfe76af9736599699d51a5f60019f6 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Forum Software

Vendor

• BlackBeltTechnology

Name

• pi-agent-dashboard

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8.0

License

• open-source

Website

• Product: https://github.com/BlackBeltTechnology/pi-agent-dashboard/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #973084: https://github.com/BlackBeltTechnology pi-agent-dashboard <=v0.8.0 Remote Code Excution (by researchersongwu)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion