CVE-2026-108372

Received Received - Intake

Cross-Origin Resource Sharing (CORS) Misconfiguration in LoopX

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-18

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-108372

Affected Vendors & Products

Vendor	Product	Version / Range
huangruiteng	loopx	>= 0.0.1, < 0.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-942	The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

LoopX is a state kernel and control plane for loop engineering. From versions 0.0.1 to 0.4.5, the `loopx serve-status` command sends unauthenticated responses with `Access-Control-Allow-Origin: *` on predictable loopback ports. This allows remote attackers to trick users into visiting malicious web content, which then triggers cross-origin requests to sensitive endpoints like /status.json or /review-material, exposing internal system state and file paths.

Detection Guidance

Check if LoopX is running on predictable loopback ports (e.g., 8080 or similar) and verify if unauthenticated responses include 'Access-Control-Allow-Origin: *' headers. Inspect network traffic for requests to /status.json, /review-material, /, or /control-plane/configure-goal/dry-run endpoints.

Impact Analysis

If you run LoopX versions 0.0.1 to 0.4.5, an attacker could exploit this to access sensitive data like control-plane state, goal details, local file paths, or dry-run configurations. This could lead to information disclosure or unauthorized system reconnaissance, but does not allow file modification or arbitrary code execution.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing sensitive data such as local file paths or internal system states. Unauthorized access to such information may constitute a data breach, requiring notification and potential penalties under these regulations.

Mitigation Strategies

Upgrade LoopX to version 0.4.5 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to LoopX ports via firewall rules and disable unauthenticated CORS headers in the status server configuration.

Hi! I’m here to help you understand CVE-2026-108372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70