---
id: CVE-2026-102344
title: >-
  Lavish: DNS rebinding allows any website to read arbitrary local files and
  inject prompts into the AI agent via the unauthenticated local server
summary: >-
  Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the
  lavish-axi loopback HTTP server did not authenticate requests or validate Host
  and Origin values on session, artifact, prompt, and polling routes. A website
  visited w…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-73
  - CWE-306
  - CWE-346
  - CWE-1427
vendor: kunchenguid
product: lavish-axi
affected:
  - lavish-axi < 0.1.43
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T20:39:41.255Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102344'
references:
  - url: >-
      https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2
    label: >-
      https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2
  - url: >-
      https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
    label: >-
      https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
  - url: 'https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43'
    label: 'https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43'
tags:
  - cve.org
ingestedAt: '2026-11-06T21:04:04.244Z'
epss: 0.00154
epssPercentile: 0.04568
---

## Overview

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

## Affected

- `lavish-axi < 0.1.43`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.