CVE-2026-102344

Lavish is the new editor for your HTML artifacts.

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then…

6. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-102344