CVE-2026-53649
Received Received - Intake

Joro Framework Unauthenticated RCE via Proxy API

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-53649
EUVD
EUVD-2026-70238

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bishopfox joro to 1.1.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53649 is a critical vulnerability in Joro, a web exploitation framework. In versions before 1.1.1, the default proxy mode exposes a local API on 127.0.0.1:9090 without authentication and with a wildcard CORS policy. This allows cross-origin JavaScript from any webpage to interact with privileged endpoints, enabling attackers to upload malicious plugins and trigger system restarts through the operator's browser.

Detection Guidance

Check if Joro is running in proxy mode by inspecting processes for 'joro' with arguments like '--proxy' or '-p'. Verify if the local API is bound to 127.0.0.1:9090 using commands like 'netstat -tulnp | grep 9090' or 'ss -tulnp | grep 9090'. Inspect browser network activity for unauthorized requests to 127.0.0.1:9090.

Impact Analysis

This vulnerability allows unauthenticated remote code execution (RCE) as the user running Joro. An attacker can trick a user into visiting a malicious page, which then uploads a plugin and restarts the system. The plugin executes immediately, potentially granting the attacker a reverse shell and full control over the affected system.

Compliance Impact

This vulnerability could lead to unauthorized remote code execution, potentially exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Joro to version 1.1.1 or later immediately. If upgrading is not possible, disable proxy mode or restrict access to the local API by binding it to loopback interfaces only. Ensure no browser tabs are open to untrusted websites while using Joro.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53649. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart