CVE-2026-52843
Received Received - Intake

Cross-Origin Request Forgery in Lightpanda Headless Browser

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-52843
EUVD
EUVD-2026-44714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lightpanda lightpanda 0.2.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Lightpanda before version 0.2.9 had a vulnerability where fetch() and XMLHttpRequest always sent session cookies with HTTP requests, ignoring credentials settings like omit or same-origin. This allowed attacker-controlled pages in the same session to make authenticated cross-origin requests using the victim's session cookies, enabling potential CSRF attacks.

Impact Analysis

An attacker could trick a user into visiting a malicious page within a Lightpanda session. This page could then send authenticated requests to other sites using the user's session cookies, potentially accessing or modifying sensitive data without consent.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance breaches and legal consequences.

Detection Guidance

To detect this vulnerability, check if your Lightpanda version is below 0.2.9. Run: lightpanda --version. If the version is older, the system is vulnerable. Monitor network traffic for unexpected cross-origin requests carrying session cookies.

Mitigation Strategies

Upgrade Lightpanda to version 0.2.9 or later immediately. Update the Fetch.zig and XMLHttpRequest.zig files to enforce credentials mode checks. Ensure cookies are only included for same-origin or include credentials requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart