CVE-2026-108890

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108890
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108890.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108890
Published
2026-10-12T13:15:12Z
Modified
2026-10-15T02:30:27Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization
Details

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108890.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.1"
                },
                {
                    "last_affected":  "0.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/blackbelttechnology/pi-agent-dashboard

Affected ranges

Type
GIT
Repo
https://github.com/blackbelttechnology/pi-agent-dashboard
Events
Introduced
d6ffd619b433e20ba1ba76177613b7ca0a590d87
Fixed
48fd0bad5adfe76af9736599699d51a5f60019f6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.2"
        },
        {
            "last_affected":  "0.2"
        },
        {
            "introduced":  "0.3"
        },
        {
            "last_affected":  "0.3"
        },
        {
            "introduced":  "0.4"
        },
        {
            "last_affected":  "0.4"
        },
        {
            "introduced":  "0.5"
        },
        {
            "last_affected":  "0.5"
        },
        {
            "introduced":  "0.6"
        },
        {
            "last_affected":  "0.6"
        },
        {
            "introduced":  "0.7"
        },
        {
            "last_affected":  "0.7"
        },
        {
            "introduced":  "0.8.0"
        },
        {
            "last_affected":  "0.8.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.2
0.3
0.4
0.5
0.6
0.7
0.8.0
v0.*
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.3-rc.1
v0.4.4
v0.4.5
v0.4.5-rc.1
v0.4.6
v0.5.0
v0.5.1
v0.5.3
v0.5.4
v0.6.1
v0.7.0
v0.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108890.json"