Pi Agent Dashboard CVE-2026-108890

Exploitation requires the victim to be actively running pi-agent-dashboard (version up to 0.8.0, which listens on loopback ws://127.0.0.1:8000/ws) AND to visit an attacker-controlled web page in the same browser, which then issues a cross-site WebSocket connection or blind cross-origin request that reaches terminalManager.spawn with an attacker-supplied cwd. The vulnerable pre-patch builds lack an Origin-based admission gate on the WebSocket upgrade and /api/* mutations. LIMITING FACTORS: mandatory user interaction (victim must browse to the malicious page, UI:P); the service is bound to localhost, so the attacker cannot connect directly and must pivot through the victim's browser; and only versions through 0.8.0 before patch 48fd0bad are affected. These constraints materially reduce real-world exploitability despite network reachability.

This is a genuinely low-priority issue despite being remotely reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 2.1 LOW) tells the real story: although the attack vector is network and no privileges are required, successful exploitation hinges on user interaction (UI:P) - a victim must be lured into visiting an attacker-controlled web page while running the dashboard locally. The source evidence confirms this is a cross-site request / cross-site WebSocket hijacking (CSWSH) class flaw (fix branch 'fix-ws-origin-cswsh', issue #625): any page the victim visited could open ws://127.0.0.1:8000/ws and spawn a terminal or blind-POST /api/* routes with ambient trust. Impact is bounded (VC:L/VI:L/VA:L, no scope change), consistent with CWE-285 improper authorization rather than direct code execution. Signal cross-reference: POC is publicly available (increasing opportunistic risk), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. The combination of mandatory user interaction, low technical impact, and a loopback-bound niche developer tool means the practical risk is minimal and far below what a 'network, unauthenticated, public POC' summary might superficially suggest. Note: EPSS data is absent and cannot be used to gauge exploitation probability.

A developer running pi-agent-dashboard locally (loopback port 8000) is tricked into visiting a malicious web page in the same browser. That page silently opens a cross-site WebSocket to the dashboard and invokes terminalManager.spawn with an attacker-chosen cwd, abusing the victim's ambient local trust to perform an unauthorized terminal spawn. A public proof-of-concept exists (hosted via the disclosed Google Drive link), but exploitation still requires the victim to actively browse to the attacker's page (UI:P).