Incorrect Access Control in Stencil Core 4.43.5

Executive Summary

CVE-2026-79319 is a medium-severity vulnerability in Stencil core 4.43.5 where the WebSocket debugging channel in the dev server leaks sensitive build information without authentication. Attackers can access metadata like project paths, source directories, output files, component graphs, and error details by connecting to the dev server's port.

Useful 0 Not Useful 0

Detection Guidance

Check if the Stencil dev server is running on your system by inspecting open ports with commands like 'netstat -tuln' or 'ss -tuln' to identify WebSocket connections on typical dev ports (e.g., 3333). Look for unauthorized connections to these ports from external sources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized actors to gather sensitive information about your development environment. Attackers could use leaked metadata to map your project structure, identify errors, or plan further attacks against your system. The impact is primarily reconnaissance, but it could lead to deeper exploitation if combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may expose sensitive project data, which could violate GDPR if personal data is involved or HIPAA if health-related information is leaked. Organizations must ensure development environments are secured to prevent unauthorized access to sensitive data, as such leaks could result in compliance violations and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict access to the Stencil dev server by binding it to localhost only (e.g., 'stencil start --address 127.0.0.1') or use a firewall to block external access. Avoid exposing the dev server to untrusted networks until a patch is released.

Useful 0 Not Useful 0