CVE-2026-53649

Name of the Vulnerable Software and Affected Versions Joro versions prior to 1.1.1

Description In default proxy mode, the software exposes a local API on 127.0.0.1:9090 that lacks authentication and implements a permissive wildcard CORS policy. Because multipart/form-data is a CORS-safelisted content type, cross-origin JavaScript from a visited webpage can send requests to privileged endpoints without triggering a preflight request. An attacker can exploit this to upload a native plugin and trigger a system restart. Since the plugin.Open() function executes the plugin's init() function before symbol lookup, the uploaded payload executes automatically upon restart, leading to remote code execution as the operator's user.

Technical details include the following affected components:

Recommendations Update Joro to a version later than 1.1.0. As a temporary mitigation, restrict access to the local API port 9090 or avoid visiting untrusted websites while the software is running in proxy mode.