Pi Agent Dashboard
Monthly
Cross-site WebSocket hijacking and request-forgery in BlackBeltTechnology pi-agent-dashboard through 0.8.0 lets any web page the victim visits open an unauthenticated WebSocket to the loopback dashboard (ws://127.0.0.1:8000/ws), receive the session snapshot, spawn a terminal, and blind-POST to /api/* and /auth/logout using the victim's ambient trust, because the gateway validates neither Origin nor a CSRF gate on those paths. Exploitation requires the dashboard to be running locally and the user to browse an attacker-controlled page on the same host (UI:P/UI:R); no credentials are needed (PR:N), but the pre-patch impact is limited to low integrity (VI:L / CVSS 4.0 base 5.3 Medium) since CORS only ever hid responses, not requests. Publicly available exploit code exists (a GitHub issue tracking the flaw and an upstream fix PR), and the vendor shipped a patched release; no CISA KEV entry has been recorded, so active in-the-wild exploitation is not confirmed.
Cross-site request attacks can reach the terminal-spawn handler in BlackBeltTechnology pi-agent-dashboard 0.8.0 and earlier, letting a malicious web page open a WebSocket or blind-POST to the loopback service and invoke terminalManager.spawn with an attacker-chosen working directory, because pre-patch builds enforce no Origin-based authorization gate on the WebSocket upgrade or on /api/* mutation routes. Exploitation is unauthenticated from the network's perspective but requires the victim to have the dashboard running and to visit an attacker-controlled page in the same browser, making user interaction mandatory; publicly available exploit code exists (disclosed via VulDB and a linked public drive folder), but there is no CISA KEV listing and no confirmed active exploitation, and our assessment rates this a genuinely low-priority issue despite remote reachability given the loopback binding, mandatory interaction, and only low confidentiality/integrity/availability impact.
Cross-site WebSocket hijacking and request-forgery in BlackBeltTechnology pi-agent-dashboard through 0.8.0 lets any web page the victim visits open an unauthenticated WebSocket to the loopback dashboard (ws://127.0.0.1:8000/ws), receive the session snapshot, spawn a terminal, and blind-POST to /api/* and /auth/logout using the victim's ambient trust, because the gateway validates neither Origin nor a CSRF gate on those paths. Exploitation requires the dashboard to be running locally and the user to browse an attacker-controlled page on the same host (UI:P/UI:R); no credentials are needed (PR:N), but the pre-patch impact is limited to low integrity (VI:L / CVSS 4.0 base 5.3 Medium) since CORS only ever hid responses, not requests. Publicly available exploit code exists (a GitHub issue tracking the flaw and an upstream fix PR), and the vendor shipped a patched release; no CISA KEV entry has been recorded, so active in-the-wild exploitation is not confirmed.
Cross-site request attacks can reach the terminal-spawn handler in BlackBeltTechnology pi-agent-dashboard 0.8.0 and earlier, letting a malicious web page open a WebSocket or blind-POST to the loopback service and invoke terminalManager.spawn with an attacker-chosen working directory, because pre-patch builds enforce no Origin-based authorization gate on the WebSocket upgrade or on /api/* mutation routes. Exploitation is unauthenticated from the network's perspective but requires the victim to have the dashboard running and to visit an attacker-controlled page in the same browser, making user interaction mandatory; publicly available exploit code exists (disclosed via VulDB and a linked public drive folder), but there is no CISA KEV listing and no confirmed active exploitation, and our assessment rates this a genuinely low-priority issue despite remote reachability given the loopback binding, mandatory interaction, and only low confidentiality/integrity/availability impact.