lavish-axi vulnerabilities

CVEs whose affected-version data names the lavish-axi package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-102344High· 8.1

yesterday

Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited w…

▾ Twilightkunchenguid · lavish-axiEPSS 0.15%via CVEORG