CVE-2026-124587 · Other
NO FIX YET · SEE WHAT TO DO
A flaw in the Electrobun desktop app code of elizaOS Eliza 2.0.3-beta.7 lets a remote party reach an HTTP server component and read information it should not see. A public exploit exists.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The flaw is in the Electrobun desktop app's lifecycle code, which runs an HTTP server for the app. Teams running the Eliza desktop app, or building from that path, should look at it. Teams using only the agent libraries or a hosted deployment without the Electrobun app can likely skip it, but the sources do not confirm that.
Not affected if not-using-electrobun-desktop-app
Who cares ai-agents, electrobun, eliza, elizaos
2.0.3-beta.7 or earlier.packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts and check whether it is included in your build.cf6fa193017e70884e01c5bb7890f74b6b2b79d2.A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.