CVE-2026-112101

BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation

State: Published
Severity: 5.3 Medium
Published: Oct 19, 2026
Updated: Oct 19, 2026
Reserved: Oct 18, 2026

Description

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-346 Origin Validation Error
CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
pi-agent-dashboardBlackBeltTechnology	0.1Affected 0.2Affected 0.3Affected 0.4Affected 0.5Affected 0.6Affected 0.7Affected 0.8.0Affected 0.9.0Not affected

References

VDB-421967 | BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationvdb-entrytechnical-description
VDB-421967 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-112101 | CVE Analysis and Reportthird-party-advisory
Submit #1012811 | https://github.com/BlackBeltTechnology/pi-agent-dashboard pi-agent-dashboard 0.8.0 Local Sensitive Logic Exposure leading to Command Excutionthird-party-advisory
https://github.com/BlackBeltTechnology/pi-agent-dashboard/issues/625exploitissue-tracking
https://github.com/BlackBeltTechnology/pi-agent-dashboard/pull/636issue-trackingpatch
https://github.com/BlackBeltTechnology/pi-agent-dashboard/commit/48fd0bad5adfe76af9736599699d51a5f60019f6patch
https://github.com/BlackBeltTechnology/pi-agent-dashboard/releases/tag/v0.9.0patch
https://github.com/BlackBeltTechnology/pi-agent-dashboard/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.