---
id: CVE-2026-112101
title: BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation
summary: >-
  A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to
  0.8.0. The affected element is an unknown function of the file
  /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway.
  Executing a manipul…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-346
  - CWE-345
vendor: BlackBeltTechnology
product: pi-agent-dashboard
affected:
  - pi-agent-dashboard 0.1
  - pi-agent-dashboard 0.2
  - pi-agent-dashboard 0.3
  - pi-agent-dashboard 0.4
  - pi-agent-dashboard 0.5
  - pi-agent-dashboard 0.6
  - pi-agent-dashboard 0.7
  - pi-agent-dashboard 0.8.0
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:30:25.707Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112101'
references:
  - url: 'https://vuldb.com/vuln/421967'
    label: >-
      VDB-421967 | BlackBeltTechnology pi-agent-dashboard WebSocket Gateway
      origin validation
  - url: 'https://vuldb.com/vuln/421967/cti'
    label: 'VDB-421967 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112101'
    label: CVE-2026-112101 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1012811'
    label: >-
      Submit #1012811 |
      https://github.com/BlackBeltTechnology/pi-agent-dashboard
      pi-agent-dashboard 0.8.0  Local Sensitive Logic Exposure leading to
      Command Excution
  - url: 'https://github.com/BlackBeltTechnology/pi-agent-dashboard/issues/625'
  - url: 'https://github.com/BlackBeltTechnology/pi-agent-dashboard/pull/636'
  - url: >-
      https://github.com/BlackBeltTechnology/pi-agent-dashboard/commit/48fd0bad5adfe76af9736599699d51a5f60019f6
  - url: >-
      https://github.com/BlackBeltTechnology/pi-agent-dashboard/releases/tag/v0.9.0
  - url: 'https://github.com/BlackBeltTechnology/pi-agent-dashboard/'
tags:
  - cve.org
ingestedAt: '2026-10-19T11:23:01.760Z'
---

## Overview

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.0 is sufficient to fix this issue. This patch is called 48fd0bad5adfe76af9736599699d51a5f60019f6. It is recommended to upgrade the affected component.

## Affected

- `pi-agent-dashboard 0.1`
- `pi-agent-dashboard 0.2`
- `pi-agent-dashboard 0.3`
- `pi-agent-dashboard 0.4`
- `pi-agent-dashboard 0.5`
- `pi-agent-dashboard 0.6`
- `pi-agent-dashboard 0.7`
- `pi-agent-dashboard 0.8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.