Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local…
Affects lavish-axi 0.1.42 and earlier while its local HTTP server runs (default 127.0.0.1:4387). The fix is in 0.1.43.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 0.1.43
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affected versions are 0.1.42 and earlier of lavish-axi (npm). The lavish-axi loopback HTTP server is running (default bind 127.0.0.1:4387).
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Lavish's local server lets an attacker read any file the server process can access and queue prompts into an active AI agent session. An attacker can reach it remotely over the network without logging in, but only if a user visits a malicious website that uses DNS rebinding to reach the local service.
Read the original description
Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.1/10CVSS 8.1
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
What to do
Check whether your setup matches what the bug needs.
Affected versions are 0.1.42 and earlier of lavish-axi (npm). The lavish-axi loopback HTTP server is running (default bind 127.0.0.1:4387).Upgrade to a fixed version: 0.1.43.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- kunchenguid lavish-axi
fixed in 0.1.43
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-102344
Is CVE-2026-102344 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A website can use DNS rebinding to reach lavish-axi's local HTTP server, which has no authentication. That lets it read any file the server process can read and inject prompts into an active AI agent session when the artifact path is known or guessed.Source: github.com
Which versions are affected by CVE-2026-102344?
lavish-axi: before 0.1.43.Source: cve.now feed data
Am I affected, and how do I check?
Versions 0.1.42 and earlier of lavish-axi (npm) are affected while the loopback HTTP server is running, by default on 127.0.0.1:4387. To check the installed version, run npm list -g lavish-axi.Source: github.com
How do I fix CVE-2026-102344?
Upgrade lavish-axi to 0.1.43 or later, which contains the fix.Source: github.com