CVE-2026-88061
Received Received - Intake

Unauthenticated Command Injection in Career-Ops Local Dashboard

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88061
EUVD
EUVD-2026-75704

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
career-ops career-ops to 0.8.0 (exc)
career-ops career-ops 0.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1385 The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88061 is a vulnerability in the career-ops local web dashboard where /api routes allowed command execution and file operations without validating request origin or restricting access to loopback addresses. This enabled unauthenticated remote code execution if the dashboard was running while a user visited a malicious page or if the dashboard was accessible from the local network.

Detection Guidance

Check if the career-ops dashboard is running on a non-loopback address (e.g., 0.0.0.0) by inspecting process bindings. Look for unexpected command execution or file writes in system logs. Verify if the dashboard API routes (/api/) are accessible from external sources by testing with curl commands targeting localhost or network addresses.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary commands on your machine as the user running the dashboard. This might lead to data theft, malware installation, or system compromise. It requires the attacker to trick you into visiting a malicious page or access the dashboard from the local network if it's not bound to loopback.

Compliance Impact

This vulnerability could lead to unauthorized access and data exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Update to the latest version (0.8.0 or later) via git pull. Stop the dashboard if running and restart it bound explicitly to 127.0.0.1. Avoid running the dashboard on non-loopback addresses unless necessary. Review environment variables to ensure no unintended hosts are allowed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88061. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart