CVE-2026-122028 · Other
NO FIX YET
Nstbrowser 1.21.0 exposes an unknown function at /agent/info in its Local Agent API that leaks information when a crafted request is sent. A public exploit exists, and the vendor did not respond to disclosure.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Nstbrowser 1.21.0 with its Local Agent API enabled and reachable over the network are exposed. The sources do not say whether the API listens on all interfaces by default, so the exact exposure is unknown. Machines where Nstbrowser is not installed, or where the agent API is bound only to localhost, are less exposed.
Not affected if localhost-only, not-installed
Who cares local-agent-api, nstbrowser
1.21.0 on machines that run itNo fix yet, per the sources.
A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.