{"id":"CVE-2026-114574","kind":"vulnerability","aliases":["CVE-2026-114574"],"related":[],"title":"massCode: local HTTP service leaks information to remote attackers","description":"A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.","summary":"The massCode 5.10 desktop app's local HTTP service, in src/main/api/index.ts, has a flaw that lets a remote attacker obtain information it should not expose. Public exploit details exist, and the NVD entry rates it medium (CVSS 5.0).","severity":"medium","cvss":5.0,"epss":0.00309,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","local-http-service","masscode","other"],"not_affected_if":[],"how_to_check":"- Check the installed massCode version, for example against the app's About dialog or package metadata, and see whether it is `5.10`.\n- Confirm whether the local HTTP service is listening, for example with `lsof -i -P | grep LISTEN` and looking for the massCode process.","fix":"- Apply the patch referenced by the advisory, commit `d25d8fa3f5a1e34285c8634f18729650c0c05cda`, by moving to a massCode release that includes it (fixed version: unknown).","status":"open","published_at":"2026-10-22T01:16:58+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:29:29+00:00","updated_at":"2026-10-25T04:29:29+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:29:29Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch referenced by the advisory, commit `d25d8fa3f5a1e34285c8634f18729650c0c05cda`, by moving to a massCode release that includes it (fixed version: unknown).","reach":"internet","title":"massCode: local HTTP service leaks information to remote attackers","impact":"low","summary":"The massCode 5.10 desktop app's local HTTP service, in src/main/api/index.ts, has a flaw that lets a remote attacker obtain information it should not expose. Public exploit details exist, and the NVD entry rates it medium (CVSS 5.0).","category":"other","nicknames":[],"who_cares":["masscode","desktop","local-http-service"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker reads information the local service exposes, such as stored snippets","analyst_note":"Find the fixed release version and whether the service binds beyond localhost; check the commit d25d8fa3f5a1e34285c8634f18729650c0c05cda and the NVD entry for the exploit reference.","how_to_check":"- Check the installed massCode version, for example against the app's About dialog or package metadata, and see whether it is `5.10`.\n- Confirm whether the local HTTP service is listening, for example with `lsof -i -P | grep LISTEN` and looking for the massCode process.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running massCode 5.10 on a machine where its local HTTP service is reachable from the network are exposed. The sources do not say whether a default install binds that service beyond localhost, so a machine that only runs massCode locally with no network exposure is lower risk. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000932,"input_tokens":3405,"output_tokens":1184,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114574':12A,15A '-2026':11A,14A '5.0':59B '5.10':24B,69C 'advis':118C 'affect':70C 'app':26B 'attack':9A,40B,97C 'compon':81C 'correct':124C 'cve':10A,13A 'cvss':58B 'd25d8fa3f5a1e34285c8634f18729650c0c05cda':115C 'desktop':16B,25B 'detail':49B 'detect':65C 'disclos':103C 'disclosur':90C 'entri':54B 'exist':50B 'exploit':48B,100C 'expos':46B 'file':77C 'flaw':35B 'function':74C 'http':3A,19B,29B,83C 'implement':120C 'inform':6A,42B,89C 'issu':126C 'launch':95C 'lead':87C 'leak':5A 'let':37B 'local':2A,18B,28B,82C 'local-http-servic':17B 'manipul':86C 'masscod':1A,21B,23B,68C 'masscodeio':67C 'may':106C 'medium':57B 'name':110C 'nvd':53B 'obtain':41B 'patch':113C,122C 'possibl':93C 'public':47B,104C 'rate':55B 'remot':8A,39B,98C 'secur':61C 'servic':4A,20B,30B,84C 'src/main/api/index.ts':32B,78C 'unknown':73C 'use':108C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Teams running massCode 5.10 on a machine where its local HTTP service is reachable from the network are exposed. The sources do not say whether a default install binds that service beyond localhost, so a machine that only runs massCode locally with no network exposure is lower risk. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114574","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114574","severity":null,"published_at":"2026-10-22T01:16:58+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114574","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114574","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}