Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108890— BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization

Quick assessment

Affected
BlackBeltTechnology pi-agent-dashboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 BlackBeltTechnology pi-agent-dashboard 0.8.0 及更早版本中发现了一个漏洞。该漏洞影响组件“Terminal Handler”（终端处理器）中的文件 里的函数 。通过对参数 进行操纵，可导致不正确的授权行为。攻击可以远程发起。该漏洞的利用方法已公开披露，并可被利用。补丁的标识为 。建议安装补丁以解决此问题。厂商在早期即被联系，并以非常专业的态度迅速响应，发布了受影响产品的修复版本。

CVSS 6.3 · Medium EPSS 0.50% · P41

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

VendorProduct Version RangeStatus
BlackBeltTechnology pi-agent-dashboard 0.1 affected
0.2 affected
0.3 affected
0.4 affected
0.5 affected
0.6 affected
0.7 affected
0.8.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108890

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of the file packages/server/src/browser-handlers/terminal-handler.ts of the component Terminal Handler. The manipulation of the argument cwd leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 48fd0bad5adfe76af9736599699d51a5f60019f6. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
BlackBeltTechnology pi-agent-dashboard 0.1 cpe:2.3:a:blackbelttechnology:pi-agent-dashboard:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-108890

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108890

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108890 (1)

Proof of Concept for CVE-2026-108890 (1)

News Coverage for CVE-2026-108890 (1)

IV. Related Vulnerabilities

Same weakness: CWE-285

V. Comments for CVE-2026-108890

No comments yet

Leave a comment