EUVD-2026-19061Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A security vulnerability has been detected in badlogic pi-mono up to 0.58.4. This vulnerability affects the function discoverAndLoadExtensions of the file packages/coding-agent/src/core/extensions/loader.ts. The manipulation leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in badlogic pi-mono up to version 0.58.4 allows authenticated remote attackers to achieve remote code execution through the discoverAndLoadExtensions function in the extension loader module. Publicly available exploit code exists, and the vendor has not responded to early disclosure notifications despite contact attempts. The vulnerability carries moderate CVSS scoring (6.3) but represents a significant risk due to public exploit availability and lack of vendor engagement.
Technical ContextAI
The vulnerability exists in the extension loading mechanism of pi-mono, specifically within the discoverAndLoadExtensions function located in packages/coding-agent/src/core/extensions/loader.ts. This is a CWE-94 code injection vulnerability where untrusted input is processed without proper sanitization before being executed or interpreted as code. Pi-mono appears to be a coding-agent framework, and the extension loader is responsible for discovering and loading extensions dynamically. When the loader processes extension metadata or configuration, it fails to properly validate or sanitize input, allowing an authenticated user to inject malicious code that will be executed with the privileges of the application. The affected product is identified by CPE cpe:2.3:a:badlogic:pi-mono:*:*:*:*:*:*:*:* with versions up to and including 0.58.4.
RemediationAI
No vendor-released patch has been independently confirmed at time of analysis due to vendor non-responsiveness to disclosure. Users should immediately upgrade pi-mono to a version beyond 0.58.4 if such versions become available, or implement compensating controls by restricting authentication access to the pi-mono application to trusted users only, disabling or auditing the extension loading functionality if not essential, and monitoring for suspicious extension loading activities. Given the public exploit availability and lack of vendor engagement, consider alternative solutions or forking the project if security is critical. Check the badlogic project repository (https://github.com/badlogic) and VulDB references (https://vuldb.com/vuln/355326) periodically for patch releases. Refer to the exploit discussion at https://github.com/August829/CVEP/issues/27 for technical details that may inform mitigation strategies.
Authentication bypass in badlogic pi-mono up to version 0.58.4 allows authenticated attackers to escalate privileges or
Cross-site scripting (XSS) in badlogic pi-mono 0.58.4 SVG Artifact Handler allows unauthenticated remote attackers to in
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today