CVE-2026-0898 File upload in Pega Robot Studio
Attackers can write arbitrary files via malicious websites when developers use interrogation mode in Pega Robot Studio, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-0898?
CVE-2026-0898 is a critical vulnerability in Pegasystems Pega Robot Studio, published on 23 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are automating Google Chrome and Microsoft Edge using either version 22.1 or R25. This vulnerability does not affect Robot Runtime users. A bad actor could create a website that includes malicious code. The vulnerability may be exploited if a Pega Robot Studio developer is deceived into visiting this website during interrogation mode in Robot Studio.
Weakness: CWE-284
Which versions are affected by CVE-2026-0898?
How do I fix CVE-2026-0898?
No fix has been published for CVE-2026-0898 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-0898 being exploited?
There is no known exploitation of CVE-2026-0898 in the wild and no public exploit code.
Sources
Also known as GHSA-5c89-ppg6-hr22.