Live › vulnerability › CVE-2026-112101
Go to dashboardThe pi-agent-dashboard WebSocket Gateway fails to validate origin when the cwd argument is manipulated, letting a remote party reach its functions. The sources do not state the full impact beyond origin validation failure, though a public exploit is reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running pi-agent-dashboard version 0.8.0 or earlier that expose its WebSocket Gateway. The sources do not say whether the gateway is exposed by default or only in certain configurations.
No product ranges from the sources yet.
0.8.0 or earlier0.9.0 (patch 48fd0bad5adfe76af9736599699d51a5f60019f6)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-112101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.