CVE-2026-123787 · Other
NO FIX YET · SEE WHAT TO DO
VidBee, a desktop video downloader, has a weakness in its Local HTTP Service (apps/desktop/src/main/local-api.ts) that lets a remote manipulation expose information. A public exploit exists, so an attacker could read data the app should keep private.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Installations of VidBee up to 1.3.13 and 2.0.2 are affected, since the flaw sits in the app's Local HTTP Service. The sources do not say whether the service is on by default, so unknown whether every install is reachable. Installs already on 2.2.0 or later are not affected.
Not affected if fixed-version-installed
Who cares desktop, local-http-service, vidbee
1.3.13 and 2.0.2 are listed as affected.2.2.0; the patch commit is 141b8d39c1c11da4589264f814cee077df81e7f6.A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.