https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 18:37:43 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-97875 <p>Rojo&#39;s &#34;rojo serve&#34; HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.</p> <p>Rojo&#39;s &#34;rojo serve&#34; HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.</p> https://db.gcve.eu/vuln/fkie_cve-2026-97875 https://db.gcve.eu/vuln/rustsec-2026-0279 <p><strong>Affected:</strong> crates.io: rojo</p> <p>Rojo&#39;s `rojo serve` command starts an unauthenticated HTTP API on localhost (default port 34872) with no `Host` or `Origin` header validation. While direct cross-origin `fetch()` requests from a malicious website are blocked by the browser&#39;s default CORS policy, an attacker can use DNS rebinding to bypass this restriction entirely. The serve API is a two-way sync protocol. Once a DNS rebind is established, a malicious webpage visited by a developer running `rojo serve` can, without any further user interaction: - **Read the full project source:** `GET /api/rojo` returns the session ID, root instance ID, and project name. `GET /api/read/{id}` enumerates the complete instance tree including all script contents, exposing proprietary game logic, configuration, and any secrets embedded in source files. - **Write to project files on disk:** `POST /api/write` pushes changes back through Rojo&#39;s sync pipeline, allowing an attacker to inject arbitrary Lua into the developer&#39;s project. If the developer then publishes their game, the injected code executes on every player&#39;s client — a supply chain attack vector. - **Launch local programs:** `POST /api/open/{id}` calls the OS-level `opener::open()` function, which invokes the platform&#39;s default handler (`open` on macOS, `xdg-open` on Linux, `start` on Windows) for the target file. Exploitation requires only that `rojo serve` is running (the standard Roblox development workflow) and that the developer visits an att…</p> <p><strong>Affected:</strong> crates.io: rojo</p> <p>Rojo&#39;s `rojo serve` command starts an unauthenticated HTTP API on localhost (default port 34872) with no `Host` or `Origin` header validation. While direct cross-origin `fetch()` requests from a malicious website are blocked by the browser&#39;s default CORS policy, an attacker can use DNS rebinding to bypass this restriction entirely. The serve API is a two-way sync protocol. Once a DNS rebind is established, a malicious webpage visited by a developer running `rojo serve` can, without any further user interaction: - **Read the full project source:** `GET /api/rojo` returns the session ID, root instance ID, and project name. `GET /api/read/{id}` enumerates the complete instance tree including all script contents, exposing proprietary game logic, configuration, and any secrets embedded in source files. - **Write to project files on disk:** `POST /api/write` pushes changes back through Rojo&#39;s sync pipeline, allowing an attacker to inject arbitrary Lua into the developer&#39;s project. If the developer then publishes their game, the injected code executes on every player&#39;s client — a supply chain attack vector. - **Launch local programs:** `POST /api/open/{id}` calls the OS-level `opener::open()` function, which invokes the platform&#39;s default handler (`open` on macOS, `xdg-open` on Linux, `start` on Windows) for the target file. Exploitation requires only that `rojo serve` is running (the standard Roblox development workflow) and that the developer visits an att…</p> https://db.gcve.eu/vuln/rustsec-2026-0279