Description

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T21:17:05.323Z",
  "pubdate": "2026-11-06T21:17:05.323Z",
  "executiveSummary": "The Lavish editor, prior to version 0.1.43, contains a critical security vulnerability in its internal loopback HTTP server. The issue stems from a failure to perform request authentication or validate Host and Origin headers across sensitive API endpoints, including those managing sessions, artifacts, prompts, and polling. This configuration allows a remote attacker to conduct DNS rebinding attacks against the local server.\nBy coercing a user to visit an attacker-controlled website while the Lavish server is active, the attacker can execute same-origin browser requests to the local service. This bypass effectively treats the attacker's web content as having local-origin access. The primary impact is the unauthorized disclosure of arbitrary files readable by the server process, as well as the ability to inject text into active agent sessions. This vulnerability poses a severe risk to data confidentiality and integrity, as it grants attackers the ability to exfiltrate local files and manipulate active editor states without user consent. The exploitation requires no prior authentication, relying solely on user interaction by visiting a malicious webpage.",
  "technicalDetails": "The vulnerability resides within the lavish-axi loopback HTTP server component integrated into the Lavish editor. The root cause is a comprehensive lack of security controls for cross-origin request validation and identity verification. Specifically, the server fails to implement CORS (Cross-Origin Resource Sharing) policies or verify the Host and Origin headers, which are essential for protecting loopback services from browser-based attacks.\nThe attack vector utilizes DNS rebinding to circumvent browser-enforced same-origin policies. An attacker initiates this by hosting a malicious website that targets the local loopback interface (e.g., 127.0.0.1). By forcing a DNS resolution change after the initial request, the attacker tricks the victim's browser into sending requests to the local Lavish-axi service, which the browser erroneously treats as being on the same origin as the attacker's site.\nThe exploitation process follows a specific sequence of operations: First, the attacker triggers a request to POST /api/sessions. Because the server does not require authentication, the attacker can submit a caller-selected file path. The server returns a deterministic session key associated with this path. Subsequently, the attacker performs a GET request to /artifact/:key/index.html. The server, failing to validate that the session was properly established or that the requester has authorization, returns the contents of the file specified during the initial POST request. This allows for arbitrary file read primitives based on the file system permissions of the process running the Lavish-axi server.\nFurthermore, the vulnerability extends to session manipulation. If an artifact path is known or can be guessed by the attacker, they can send requests to POST /api/:key/prompts. This allows the injection of arbitrary text into an active agent session, potentially leading to unauthorized data processing or execution of unintended actions within the context of the editor's agent features. Because these routes remain exposed without middleware enforcement for session tokens or request origin verification, the attack surface is exposed to any browser-based entity capable of communicating with the local host. This vulnerability is present in all versions of Lavish prior to 0.1.43, and the exposure is limited to systems where the Lavish process is actively listening on the network interface."
}