CVE-2026-102344

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

• CWE-73
• CWE-306
• CWE-346

• https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
• https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43
• https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102335Nginx Proxy Manager through 2.16.0 fails to restrict the adv…7.1
• CVE-2026-102337Webmin is a web-based system administration tool for Unix-li…4.9
• CVE-2026-102339Telepresence enables local development against a remote Kube…8.2
• CVE-2026-10234A vulnerability was detected in Mettle sendportal up to 3.0.…3.5
• CVE-2026-102340Telepresence enables local development against a remote Kube…8.5
• CVE-2026-102342ammonia is a Rust library for repairing and securing untrust…5.4
• CVE-2026-102345Zammad is a web based open source helpdesk/customer support …5.1
• CVE-2026-10235A flaw has been found in CodeAstro Ingredients Stock Managem…6.3
• CVE-2026-102354BentoPDF is a privacy-focused PDF toolkit that runs in the b…6.8
• CVE-2026-102356Kroki creates diagrams from textual descriptions. From 0.26.…5
• CVE-2026-102359Kroki creates diagrams from textual descriptions. Prior to 0…7.5
• CVE-2026-10236A vulnerability has been found in SourceCodester Water Billi…7.3