CVE-2026-5556

Vulnerability

Overview

CVE-2026-5556 is a code injection vulnerability in the badlogic pi-mono project, affecting versions up to 0.58.4. The flaw resides in the discoverAndLoadExtensions function within packages/coding-agent/src/core/extensions/loader.ts. The function fails to properly sanitize input, allowing an attacker to inject and execute arbitrary code through the extension loading mechanism.

Exploitation

The vulnerability is remotely exploitable, meaning an attacker can trigger it over the network without requiring local access. The exact prerequisites are not detailed, but the function is likely exposed via an API or service that processes extension data. No authentication is explicitly required, making it accessible to unauthenticated remote attackers. A public exploit has been disclosed, increasing the risk of active exploitation [1].

Impact

Successful exploitation leads to arbitrary code execution in the context of the application. This could allow an attacker to compromise the affected system, steal sensitive data, or pivot to internal networks. Given the code injection nature, the impact is severe despite the medium CVSS score.

Mitigation

The vendor was contacted but did not respond, and no patch is available. Users of pi-mono should consider disabling the extension loading feature or implementing network-level controls to restrict access. As the exploit is public, immediate action is recommended to reduce exposure.