Live › vulnerability › CVE-2026-114574
Go to dashboardThe massCode 5.10 desktop app's local HTTP service, in src/main/api/index.ts, has a flaw that lets a remote attacker obtain information it should not expose. Public exploit details exist, and the NVD entry rates it medium (CVSS 5.0).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running massCode 5.10 on a machine where its local HTTP service is reachable from the network are exposed. The sources do not say whether a default install binds that service beyond localhost, so a machine that only runs massCode locally with no network exposure is lower risk. unknown
No product ranges from the sources yet.
5.10.lsof -i -P | grep LISTEN and looking for the massCode process.d25d8fa3f5a1e34285c8634f18729650c0c05cda, by moving to a massCode release that includes it (fixed version: unknown).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-114574")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.