CVE-2026-53656

Name of the Vulnerable Software and Affected Versions FiftyOne versions prior to 1.17.0

Description The FiftyOne App/API server and the /media endpoint unconditionally set a permissive Cross-Origin Resource Sharing (CORS) header, allowing any website visited by a user to make cross-origin requests to a locally running FiftyOne server and read the responses. Since the server is unauthenticated, this allows a malicious web page to silently request arbitrary files from the local filesystem via the /media endpoint using the filepath variable, enabling remote data exfiltration of sensitive files such as SSH keys, cloud credentials, and .env files. This issue affects users running the embedded App server locally while browsing the web, particularly on browsers that do not enforce Private Network Access protections.

Recommendations Update to FiftyOne version 1.17.0 or later. Do not run the FiftyOne App server while browsing untrusted websites. Keep the App server bound to localhost and avoid exposing it on a network interface. Use a browser that enforces Private Network Access protections.