CVE-2026-102344

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

• https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
• https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43
• https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2
• https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2

• https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a
• https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43
• https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2
• https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2

• HIGHCVE-2026-60009PoC
• UNSCOREDCVE-2026-61742PoC
• UNSCOREDCVE-2026-77339PoC
• HIGHCVE-2026-79977PoC
• HIGHCVE-2026-92704PoC
• CRITICALCVE-2022-29966PoC
• MEDIUMCVE-2024-5563
• UNSCOREDCVE-2025-30043

Related by shared AI tags and CWE weakness class. Browse the full archive.