Description
A security vulnerability has been detected in badlogic pi-mono up to 0.58.4. This vulnerability affects the function discoverAndLoadExtensions of the file packages/coding-agent/src/core/extensions/loader.ts. The manipulation leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via code injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in badlogic pi-mono, located in the discoverAndLoadExtensions function of loader.ts, allows attackers to inject arbitrary code through manipulated input. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The weakness corresponds to code injection (CWE-74) and potentially code execution (CWE-94).

Affected Systems

badlogic pi-mono, versions up to 0.58.4 are affected. Any deployment of the coding-agent component that imports extensions via loader.ts may be vulnerable. Those running the 0.58.4 release or earlier need to upgrade.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is published, and the vendor has not released a patch yet. Remote exploitation has been confirmed publicly, so the risk remains real for systems still on vulnerable versions. Attackers can target the application over a network or exposed service that uses discoverAndLoadExtensions, and can subsequently execute arbitrary code.

Generated by OpenCVE AI on April 5, 2026 at 11:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade badlogic pi-mono to a version newer than 0.58.4.
  • If upgrading is not immediately possible, restrict inputs to trusted sources and validate extension names before loading.
  • Regularly review the coding-agent component for updates and monitor security advisories from badlogic.
  • Consider disabling the discoverAndLoadExtensions functionality if it is not required.

Generated by OpenCVE AI on April 5, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Badlogic
Badlogic pi-mono
Vendors & Products Badlogic
Badlogic pi-mono

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 09:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in badlogic pi-mono up to 0.58.4. This vulnerability affects the function discoverAndLoadExtensions of the file packages/coding-agent/src/core/extensions/loader.ts. The manipulation leads to code injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title badlogic pi-mono loader.ts discoverAndLoadExtensions code injection
Weaknesses CWE-74
CWE-94
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Badlogic Pi-mono
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T15:29:13.939Z

Reserved: 2026-04-04T13:47:01.130Z

Link: CVE-2026-5556

cve-icon Vulnrichment

Updated: 2026-04-06T15:29:10.035Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T10:16:19.520

Modified: 2026-04-24T18:14:34.620

Link: CVE-2026-5556

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:56:57Z

Weaknesses