CVE-2026-102344

HIGH

MEDIUM Priority: 0.01 BB Relevance: 66/100

Published: 2026-11-06 Modified: 2026-11-06 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: None

UI: Required

S: Unchanged

C: High

I: High

A: None

Description

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.