{"id":"CVE-2026-102344","kind":"vulnerability","aliases":["CVE-2026-102344"],"related":[],"title":"Lavish: local server lets websites read files via DNS rebinding","description":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.","summary":"The lavish-axi local HTTP server for AI agent sessions skipped authentication and Host/Origin checks before 0.1.43. A website visited while the server runs can read any file the server process can read, and queue prompts into an active agent session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","developer-machines","lavish-axi"],"not_affected_if":["server-not-running","version-0.1.43-or-later"],"how_to_check":"- Check the installed lavish-axi version; it is affected below `0.1.43`.\n- Look for a lavish-axi process listening on a loopback port while a browser is open.","fix":"- lavish-axi: upgrade to `0.1.43`.","status":"open","published_at":"2026-11-06T21:17:05+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:39+00:00","updated_at":"2026-11-06T21:46:39+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-06T21:46:39Z","model":"claude-haiku-5-5","output":{"fix":"- lavish-axi: upgrade to `0.1.43`.","reach":"internet","title":"Lavish: local server lets websites read files via DNS rebinding","impact":"high","summary":"The lavish-axi local HTTP server for AI agent sessions skipped authentication and Host/Origin checks before 0.1.43. A website visited while the server runs can read any file the server process can read, and queue prompts into an active agent session.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["lavish-axi","ai-agents","developer-machines"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads local files and injects prompts into agent sessions","analyst_note":"Sources list no product or package name and no ranges; confirm the lavish-axi package, its install base, and the default bind settings via the NVD entry or the linked vendor advisory.","how_to_check":"- Check the installed lavish-axi version; it is affected below `0.1.43`.\n- Look for a lavish-axi process listening on a loopback port while a browser is open.\n- unknown for any other setting; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.1.43-or-later","server-not-running"],"who_is_affected":"Teams running lavish-axi locally with an agent session, where a browser on the same machine can reach the loopback server. Machines without lavish-axi running, or on a fixed version, are not exposed. The sources do not say whether any default configuration is affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001096,"input_tokens":4412,"output_tokens":1309,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102344':13A,16A '-2026':12A,15A '/api':175C '/api/sessions':131C '/artifact':146C '0.1.43':46B,82C,206C 'accept':132C 'activ':68B,179C 'agent':19B,38B,69B,180C 'ai':18B,21B,37B 'ai-ag':17B 'ai-tool':20B 'allow':153C 'also':170C 'artifact':79C,102C,184C 'attack':168C,193C 'attacker-control':192C 'authent':41B,92C 'axi':28B,32B,86C 'browser':124C 'caller':135C 'caller-select':134C 'check':44B 'content':152C 'control':194C 'cve':11A,14A 'determinist':142C 'develop':24B 'developer-machin':23B 'disclosur':154C 'dns':9A,117C 'editor':75C 'exist':165C 'file':7A,57B,137C,151C,157C 'fix':204C 'get':145C 'guess':189C 'host':96C 'host/origin':43B 'html':78C 'http':34B,88C 'interact':200C 'key':144C 'key/index.html':147C 'key/prompts':176C 'known':187C 'lavish':1A,27B,31B,71C,85C 'lavish-axi':26B,30B,84C 'let':4A 'local':2A,33B,128C 'loopback':87C 'machin':25B 'new':74C 'origin':98C,123C 'path':138C,185C 'poll':105C 'post':130C,174C 'prior':80C 'process':60B,162C 'prompt':65B,103C 'queue':64B,171C 'read':6A,55B,62B 'readabl':158C 'rebind':10A,118C 'request':93C,125C 'requir':198C 'return':140C,149C 'rout':106C 'run':53B,114C 'same-origin':121C 'select':136C 'send':120C 'server':3A,35B,52B,59B,89C,112C,161C 'servic':129C 'session':39B,70B,101C,143C,166C,181C 'skip':40B 'text':172C 'tool':22B 'use':116C 'user':199C 'valid':95C 'valu':99C 'via':8A 'visit':49B,109C,190C 'vulner':202C 'websit':5A,48B,108C,195C 'without':163C","nicknames":[],"mitigations":[],"who_affected":"Teams running lavish-axi locally with an agent session, where a browser on the same machine can reach the loopback server. Machines without lavish-axi running, or on a fixed version, are not exposed. The sources do not say whether any default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","developermachines","high","lavishaxi"],"campaign_type":null,"search_a":"'-102344':13A,16A '-2026':12A,15A 'cve':11A,14A 'dns':9A 'file':7A 'lavish':1A 'let':4A 'local':2A 'read':6A 'rebind':10A 'server':3A 'via':8A 'websit':5A","search_b":"'0.1.43':46B 'activ':68B 'agent':19B,38B,69B 'ai':18B,21B,37B 'ai-ag':17B 'ai-tool':20B 'authent':41B 'axi':28B,32B 'check':44B 'develop':24B 'developer-machin':23B 'file':57B 'host/origin':43B 'http':34B 'lavish':27B,31B 'lavish-axi':26B,30B 'local':33B 'machin':25B 'process':60B 'prompt':65B 'queue':64B 'read':55B,62B 'run':53B 'server':35B,52B,59B 'session':39B,70B 'skip':40B 'tool':22B 'visit':49B 'websit':48B","search_c":"'/api':175C '/api/sessions':131C '/artifact':146C '0.1.43':82C,206C 'accept':132C 'activ':179C 'agent':180C 'allow':153C 'also':170C 'artifact':79C,102C,184C 'attack':168C,193C 'attacker-control':192C 'authent':92C 'axi':86C 'browser':124C 'caller':135C 'caller-select':134C 'content':152C 'control':194C 'determinist':142C 'disclosur':154C 'dns':117C 'editor':75C 'exist':165C 'file':137C,151C,157C 'fix':204C 'get':145C 'guess':189C 'host':96C 'html':78C 'http':88C 'interact':200C 'key':144C 'key/index.html':147C 'key/prompts':176C 'known':187C 'lavish':71C,85C 'lavish-axi':84C 'local':128C 'loopback':87C 'new':74C 'origin':98C,123C 'path':138C,185C 'poll':105C 'post':130C,174C 'prior':80C 'process':162C 'prompt':103C 'queue':171C 'readabl':158C 'rebind':118C 'request':93C,125C 'requir':198C 'return':140C,149C 'rout':106C 'run':114C 'same-origin':121C 'select':136C 'send':120C 'server':89C,112C,161C 'servic':129C 'session':101C,143C,166C,181C 'text':172C 'use':116C 'user':199C 'valid':95C 'valu':99C 'visit':109C,190C 'vulner':202C 'websit':108C,195C 'without':163C","first_public_at":"2026-07-22T04:52:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102344","severity":null,"published_at":"2026-11-06T21:17:05+00:00","modified_at":"2026-11-06T21:17:05+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90291,"url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90292,"url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90293,"url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-22T04:52:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}