CVE-2026-109823

Name of the Vulnerable Software and Affected Versions tidewave versions 0.8.0 through 0.9.1

Description An attacker can read the filesystem paths of an application through the Tidewave configuration. This occurs because the server does not validate the Host header and the check origin() function accepts requests that lack an Origin header. A malicious web page can use DNS rebinding to redirect its domain to the loopback address and perform a same-origin request to retrieve sensitive information. The exposed data, which includes the local username and project layout, is leaked via the /tidewave/connect endpoint or through the rendered toolbar injected into HTML responses by the Tidewave.call() function. Specifically, the Tidewave.tidewave config meta/1 function collects data such as root, framework.app paths, wsl distro, and host path and embeds it into a meta tag.

Recommendations Update tidewave to version 0.9.2 or later.