CVE-2026-124587
4.3 MEDIUMpublic exploit availablePublished 2026-11-09 · Updated 2026-11-09
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-284
Public exploit & PoC references
All references
- https://github.com/elizaOS/eliza/
- https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2
- https://github.com/elizaOS/eliza/issues/33034
- https://github.com/elizaOS/eliza/pull/33142
- https://vuldb.com/cve/CVE-2026-124587
- https://vuldb.com/submit/1039543
- https://vuldb.com/vuln/433011
- https://vuldb.com/vuln/433011/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2013-10077PoC
- MEDIUMCVE-2026-100906PoC
- MEDIUMCVE-2026-100907PoC
- MEDIUMCVE-2026-101055PoC
- MEDIUMCVE-2026-101083
- MEDIUMCVE-2026-101143
- MEDIUMCVE-2026-101146
- MEDIUMCVE-2026-102845PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.