CVE-2026-88061

Name of the Vulnerable Software and Affected Versions career-ops versions prior to 0.8.0

Description The local web dashboard web/ exposes /api routes that allow command spawning and user-file writing without validating the request origin or restricting clients to loopback addresses. This allows unauthenticated command execution as the dashboard user via cross-origin localhost requests from a malicious page in another browser tab or direct requests from the local network if the dashboard is bound beyond the loopback address. Installations via npm are not affected as the web/ directory is excluded from the published package.

Recommendations Update to version 0.8.0.