CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.

• CWE-200
• CWE-359
• CWE-918
• CWE-1385

• https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9
• https://github.com/edwardkim/rhwp/releases/tag/v0.7.15
• https://github.com/edwardkim/rhwp/security/advisories/GHSA-j972-m9fh-g22m

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54559PocketSphinx is a small speech recognizer. Prior to 5.1.1, t…6.9
• CVE-2026-5456A vulnerability was identified in Align Technology My Invisa…3.3
• CVE-2026-54560Cloudreve is a self-hosted file management and sharing syste…7.6
• CVE-2026-54561MCP Memory Keeper is an MCP server for persistent context ma…6.2
• CVE-2026-54562Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-54563Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-54567Flask-Reuploaded provides file uploads for Flask. From 1.5.0…7.5
• CVE-2026-54568Microsoft UFO open-source framework for intelligent automati…4.3
• CVE-2026-54569SENAITE.CORE is the core framework for the SENAITE laborator…9.8
• CVE-2026-5457A security flaw has been discovered in PropertyGuru AgentNet…3.3
• CVE-2026-54570AngleSharp is a .NET library for parsing angle bracket based…6.9
• CVE-2026-54571ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…8.7