---
id: "CVE-2026-114574"
kind: "vulnerability"
aliases: ["CVE-2026-114574"]
title: "massCode: local HTTP service leaks information to remote attackers"
severity: "medium"
cvss: 5.0
epss: 0.00309
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "local-http-service", "masscode", "other"]
not_affected_if: []
published_at: "2026-10-22T01:16:58+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:29:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114574", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114574", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# massCode: local HTTP service leaks information to remote attackers

The massCode 5.10 desktop app's local HTTP service, in src/main/api/index.ts, has a flaw that lets a remote attacker obtain information it should not expose. Public exploit details exist, and the NVD entry rates it medium (CVSS 5.0).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed massCode version, for example against the app's About dialog or package metadata, and see whether it is `5.10`.
- Confirm whether the local HTTP service is listening, for example with `lsof -i -P | grep LISTEN` and looking for the massCode process.

## Fix

- Apply the patch referenced by the advisory, commit `d25d8fa3f5a1e34285c8634f18729650c0c05cda`, by moving to a massCode release that includes it (fixed version: unknown).

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114574
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114574

## From the sources

A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_