A flaw in the Pega Browser Extension allows a developer to write arbitrary files on the system hosting Pega Robot Studio. The manufacturer notes that malicious code could be delivered via a web page that a developer visits while in interrogation mode. Because an attacker can write files, including potentially executable ones, this defect can lead to execution of arbitrary code or local privilege escalation. The weakness is classified as CWE-284, which indicates an unauthorized modification of system resources.

Pegasystems’s Pega Robot Studio development environment is impacted. The flaw affects version 22.1 and release 25. The issue does not affect users of Robot Runtime. The vulnerability is only relevant when developers are automating Google Chrome or Microsoft Edge through the Pega Browser Extension.

The CVSS score of 9 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is considered high risk because it requires no advanced skills—only a malicious web site accessed during interrogation mode. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation reports, yet the attack vector relies on user interaction. The product’s support document provides a remediation path, which organisations should follow promptly to mitigate this risk.