---
id: "CVE-2026-102344"
page: "https://infrastack.ai/live/CVE-2026-102344"
kind: "vulnerability"
aliases: ["CVE-2026-102344"]
title: "Lavish: local server lets websites read files via DNS rebinding"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "developer-machines", "lavish-axi"]
not_affected_if: ["server-not-running", "version-0.1.43-or-later"]
published_at: "2026-11-06T21:17:05+00:00"
first_seen_at: "2026-11-06T21:45:07+00:00"
updated_at: "2026-11-06T21:46:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102344", "first_seen_at": "2026-11-06T21:45:07+00:00"}]
exploit_sources: []
---

# Lavish: local server lets websites read files via DNS rebinding

Link for people: https://infrastack.ai/live/CVE-2026-102344 (this .md is for agents)

The lavish-axi local HTTP server for AI agent sessions skipped authentication and Host/Origin checks before 0.1.43. A website visited while the server runs can read any file the server process can read, and queue prompts into an active agent session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed lavish-axi version; it is affected below `0.1.43`.
- Look for a lavish-axi process listening on a loopback port while a browser is open.

## Fix

- lavish-axi: upgrade to `0.1.43`.

## Timeline

- 2026-11-06T21:45:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102344

## Documents

- [advisory] Vendor advisory: github.com https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2
- [fix] Patch: github.com https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
- [fix] Release notes: github.com https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43

## From the sources

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_