GHSA-6m68-r693-78qx

Source

https://github.com/advisories/GHSA-6m68-r693-78qx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6m68-r693-78qx/GHSA-6m68-r693-78qx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6m68-r693-78qx

Aliases

Published

2026-06-19T13:53:35Z

Modified

2026-07-21T14:00:36Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream

Details

Summary

The Tilt HUD WebSocket (/ws/view) is gated by a CSRF token, but the token is served by an unauthenticated endpoint and the upgrader accepts any client that omits an Origin header. When the HUD is network-exposed, an attacker can open the HUD stream and read the developer's session state.

Details

The upgrader accepts a connection when the csrf query parameter matches a process-wide token (websocketCSRFToken). That token is served as text/plain by an unauthenticated handler (WebsocketToken, mounted at /api/websocket_token), so any reachable caller can fetch it and connect to /ws/view?csrf=<token>. When the parameter does not match, the upgrader falls back to a same-origin check that returns true when the Origin header is absent, so a non-browser client that omits Origin is accepted anyway. The token has no per-session binding.

Impact

An attacker who can reach the HUD listener can open the HUD WebSocket and receive the full view stream — session state, Tiltfile contents, resource statuses, and continued updates — defeating the intended anti-CSWSH protection.

Conditions for exploitation

Affected version in >= 0.24.0, <= 0.37.3.
HUD bound to a non-loopback address (tilt up --host 0.0.0.0, or TILT_HOST set).
Network reachability to the listener (default port 10350).

Not affected

The default loopback-only bind is not reachable from the network.

Workarounds

Use the default loopback bind (omit --host, unset TILT_HOST). No complete workaround short of upgrading for non-loopback deployments.

Database specific

{
    "cwe_ids":  [
        "CWE-345"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-19T13:53:35Z",
    "nvd_published_at":  "2026-07-10T22:16:44Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/tilt-dev/tilt

Package

Name: github.com/tilt-dev/tilt; View open source insights on deps.dev
Purl: pkg:golang/github.com/tilt-dev/tilt

Affected ranges

Type: SEMVER
Events: Introduced

0.24.0

Fixed

0.37.4

Database specific

last_known_affected_version_range

"<= 0.37.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-6m68-r693-78qx/GHSA-6m68-r693-78qx.json"