CVE-2026-108890
Received Received - Intake

Improper Authorization in pi-agent-dashboard Terminal Handler

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108890
EUVD
EUVD-2026-97451

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
BlackBeltTechnology pi-agent-dashboard 0.1
BlackBeltTechnology pi-agent-dashboard 0.2
BlackBeltTechnology pi-agent-dashboard 0.3
BlackBeltTechnology pi-agent-dashboard 0.4
BlackBeltTechnology pi-agent-dashboard 0.5
BlackBeltTechnology pi-agent-dashboard 0.6
BlackBeltTechnology pi-agent-dashboard 0.7
BlackBeltTechnology pi-agent-dashboard 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in BlackBeltTechnology pi-agent-dashboard versions up to 0.8.0. It is located in the terminalManager.spawn function of the terminal-handler.ts file. The issue involves improper authorization when the cwd argument is manipulated. This allows remote attackers to potentially gain unauthorized access or execute commands.

Detection Guidance

The vulnerability affects BlackBeltTechnology pi-agent-dashboard up to version 0.8.0. To detect it, check the installed version of pi-agent-dashboard on your system. If the version is 0.8.0 or lower, the system is likely vulnerable. Use commands like 'npm list pi-agent-dashboard' or 'dpkg -l | grep pi-agent-dashboard' to verify the installed version.

Impact Analysis

The vulnerability could allow remote attackers to execute unauthorized commands or gain access to sensitive data through the terminal handler. Attackers might manipulate the cwd argument to bypass authorization checks. This could lead to data breaches, system compromise, or unauthorized system control.

Compliance Impact

The vulnerability allows unauthorized remote code execution and data access via WebSocket hijacking and CSRF attacks. This could lead to exposure of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately update pi-agent-dashboard to a version beyond 0.8.0. The patch identifier is 48fd0bad5adfe76af9736599699d51a5f60019f6. Apply the patch or upgrade to the latest version as soon as possible to address the improper authorization issue in the terminal handler component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart