{"id":"CVE-2026-102344","title":"Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server","summary":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited w…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-73","CWE-306","CWE-346","CWE-1427"],"vendor":"kunchenguid","product":"lavish-axi","affected":["lavish-axi < 0.1.43"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T20:39:41.255Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102344","references":[{"url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2","label":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"},{"url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a","label":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a"},{"url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43","label":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T21:04:04.244Z","epss":0.00154,"epssPercentile":0.04568,"slug":"CVE-2026-102344","body":"## Overview\n\nLavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.\n\n## Affected\n\n- `lavish-axi < 0.1.43`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}