CVE-2026-97875CWE-350

CVE-2026-97875

High · published September 25, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.7th percentile
Weakness
CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action
Published
2026-09-25T15:17Z
References (3)
https://github.com/rojo-rbx/rojo/pull/1270 · 74b3a70d-cca6-4d34-9789-e83b222ae3behttps://osv.dev/vulnerability/RUSTSEC-2026-0279 · 74b3a70d-cca6-4d34-9789-e83b222ae3behttps://rustsec.org/advisories/RUSTSEC-2026-0279.html · 74b3a70d-cca6-4d34-9789-e83b222ae3be
EPSS history
Timeline
  • 27 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 25 SEP 10:48Z
    DNS rebinding vulnerability in rojo serve HTTP API
    cvelistv5