CVE-2026-102344

Name of the Vulnerable Software and Affected Versions Lavish versions prior to 0.1.43

Description The lavish-axi loopback HTTP server fails to authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. This allows a website visited by a user to employ DNS rebinding—a technique used to bypass the Same-Origin Policy—to send requests to the local service. An attacker can use the endpoint "POST /api/sessions" by providing a specific file path to obtain a deterministic session key. Subsequently, the endpoint "GET /artifact/:key/index.html" can be used to disclose any file readable by the server process. Additionally, if an artifact path is known or guessed, an attacker can queue text via the endpoint "POST /api/:key/prompts" for an active agent session. This requires the user to visit a website controlled by the attacker.

Recommendations Update Lavish to version 0.1.43.