pi-agent-dashboard EUVD-2026-104154

Requires (1) the victim to be actively running pi-agent-dashboard (version ≤ 0.8.0) listening on loopback (ws://127.0.0.1:8000/ws), and (2) the victim to visit an attacker-controlled web page in a browser on the same host (UI:P / UI:R) - the malicious page's script then opens a cross-origin WebSocket that the pre-patch gateway admits without validating the Origin header, and can also drive untrusted-Origin mutations against /api/* and POST /auth/logout. Limiting factors: no server-side authentication is needed (PR:N), but exploitation is gated by the required user interaction, by the dashboard being bound to loopback rather than exposed network-wide, and by the narrow single-host victim model. Not exploitable against header-less local clients (pi-dashboard CLI, curl, the bridge) since browsers cannot omit Origin; the 0.9.0 patch closes it via a WS-upgrade Origin gate, an onRequest CSRF gate, and a pi-gateway Origin refusal.

This is a cross-site WebSocket hijacking / CSRF-class origin-validation flaw (CWE-346) in the pi-agent-dashboard WebSocket Gateway, rated CVSS 4.0 base 5.3 (Medium) with AV:N/AC:L/AT:N/PR:N/UI:P and only low integrity impact (VI:L). The signals partly conflict: the CVSS vector sets VC:N (no confidentiality impact), but the vendor's own patch notes (issue #625) state that any visited web page could open ws://127.0.0.1:8000/ws, receive the session snapshot broadcast, spawn a terminal, and blind-POST every /api/* route - that is clear confidentiality loss and potential command execution via the spawned terminal, so the official vector appears to UNDER-rate real impact. Countervailing factors keep real-world priority moderate: exploitation requires user interaction (UI:P - the victim must visit an attacker-controlled page while the dashboard is running on loopback), the product is a niche local developer dashboard rather than an internet-facing service, no EPSS score is provided, and it is NOT on the CISA KEV list. A public exploit reference exists (GitHub issue #625), so this is 'publicly available exploit code exists,' which is a distinct and weaker signal than active exploitation - there is no evidence of in-the-wild use. Net: a credible, patch-worthy browser-pivot bug for anyone running the dashboard, but not an emergency-grade internet-wide threat. Note the description's mention of a 'cwd argument' is not corroborated by the source-code evidence, which is entirely about Origin admission on the WebSocket upgrade and /api/* mutations - verify the exact trigger with the vendor.

A developer runs pi-agent-dashboard locally on 127.0.0.1:8000 and, in the same browser, visits an attacker-controlled web page. JavaScript on that page silently opens a cross-origin WebSocket to the dashboard (which, pre-0.9.0, performs no Origin validation on the upgrade), receives the broadcast session snapshot, spawns a terminal, and issues blind state-changing POSTs to /api/* routes using the victim's ambient trust. A public exploit reference is disclosed in GitHub issue #625.