This vulnerability in badlogic pi-mono (up to version 0.58.4) involves code injection via the discoverAndLoadExtensions function located in packages/coding-agent/src/core/extensions/loader.ts. The flaw allows remote attackers to inject and execute arbitrary code without user interaction and with low attack complexity. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low privileges required, and limited impact on confidentiality, integrity, and availability. The vendor was notified but has not issued any fix or advisory, and no patch links are available. The vulnerability is publicly disclosed but no known exploits in the wild have been reported.

Successful exploitation can lead to remote code injection, potentially allowing attackers to execute arbitrary code within the context of the affected application. However, the impact on confidentiality, integrity, and availability is rated as low, indicating limited damage or scope of compromise. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. In the meantime, consider restricting network exposure of affected versions and applying compensating controls to limit potential impact.