CVE-2026-108372
- Source
- https://cve.org/CVERecord?id=CVE-2026-108372
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108372.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-108372
- Aliases
- Published
- 2026-10-16T21:29:13Z
- Modified
- 2026-10-28T02:30:39Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
- Details
-
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5,
loopx serve-statusinloopx/status_server.pyusesStatusRequestHandler._send_json()anddo_OPTIONS()to sendAccess-Control-Allow-Origin: *for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests toGET /status.json,GET /review-material?goal_id=...&path=...,GET /, andPOST /control-plane/configure-goal/dry-run, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-346", "CWE-942" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108372.json" }- References
-
- https://github.com/loopx-project/loopx/releases/tag/v0.4.5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108372.json
- https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q
- https://nvd.nist.gov/vuln/detail/CVE-2026-108372
- https://github.com/loopx-project/loopx/commit/838720fba42bd22f71b5bb763ec406f7bdf4c940
- https://github.com/loopx-project/loopx/pull/3137
Affected packages
Git / github.com/loopx-project/loopx
Affected ranges
- Type
- GIT
- Repo
- https://github.com/loopx-project/loopx
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.0.1" }, { "fixed": "0.4.5" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "838720fba42bd22f71b5bb763ec406f7bdf4c940" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.4.5", "range": [ { "fixed": "80877982216577174e3e7c7cca9804c5a3a3148b" } ], "source": "REFERENCES_TAG" } ] }