SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
Affects SharpEmu 0.0.3-release.3 and earlier when the repository's debugger frontend is running. Fixed in 0.0.3-release.3-patch.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 0.0.3-release.3-patch.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The debugger frontend (tools/SharpEmu.DebuggerFrontend/debugger_frontend.py) is running and serves its HTTP API on 127.0.0.1:8765. Affected versions are 0.0.3-release.3 and earlier. The frontend is repository tooling that is not included in the release archives, so exposed users are typically contributors.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity8.3/10CVSS 8.3
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
CVE-2026-92704 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects sharpemu; fixed in 0.0.3-release.3-patch.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 0.0.3-release.3-patch.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SharpEmu, an experimental PlayStation 5 emulator for Windows and Linux, has a debugger frontend tool in its repository (not shipped in release archives) that can be abused through a malicious web page, letting an attacker run an existing program with the victim's privileges, control the emulated process, or reach network services on the host. The attack can be carried out remotely, without logging in, but it requires the victim to visit a malicious page while the debugger frontend is running, and the attack may need a non-default setup.
Read the original description
SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its do_POST handler in tools/SharpEmu.DebuggerFrontend/debugger_frontend.py does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The _read_json_body() function also accepts JSON sent with browser-simple content types instead of requiring application/json . A malicious page that can reach the loopback listener can send cross-origin requests to /api/launch , /api/command , and /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The /api/launch endpoint accepts an attacker-selected emulatorPath if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing ebootPath . The /api/command endpoint exposes debugger operations, including write-memory , set-register , and continue . The /api/connect endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1
What to do
Check whether your setup matches what the bug needs.
The debugger frontend (tools/SharpEmu.DebuggerFrontend/debugger_frontend.py) is running and serves its HTTP API on 127.0.0.1:8765. Affected versions are 0.0.3-release.3 and earlier. The frontend is repository tooling that is not included in the release archives, so exposed users are typically contributors.Upgrade to a fixed version: 0.0.3-release.3-patch.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- sharpemu sharpemu
fixed in 0.0.3-release.3-patch.1
Evidence 4
- Advisory
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-92704
Is CVE-2026-92704 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The debugger frontend's local HTTP API on 127.0.0.1:8765 has no authentication and does not check where requests come from. A cross-site request forgery flaw lets a malicious web page send requests to that API, which can lead to arbitrary process execution as the victim user, control of the attached emulator debugger, and server-side requests to services reachable from the host.Source: github.com
Which versions are affected by CVE-2026-92704?
sharpemu: before 0.0.3-release.3-patch.1.Source: cve.now feed data
Am I affected, and how do I check?
Versions 0.0.3-release.3 and earlier are affected, but only while tools/SharpEmu.DebuggerFrontend/debugger_frontend.py is running and serving on 127.0.0.1:8765. The frontend ships in the repository rather than the release archives, so check the SharpEmu version you run and whether that debugger script is running.Source: github.com
How do I fix CVE-2026-92704?
Update SharpEmu to 0.0.3-release.3-patch.1 or later. Stop running the debugger frontend if you cannot update right away.Source: github.com