{"id":"ghsa-ghsa-vx2m-gpq4-8j5q","seq":2446,"kind":"advisory","title":"LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files","url":"https://github.com/advisories/GHSA-vx2m-gpq4-8j5q","permalink":"https://vulnpulse.app/items/ghsa-ghsa-vx2m-gpq4-8j5q","summary":"影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5\nSummary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…","severity":"high","techs":["python"],"cves":["CVE-2026-108372"],"tags":["GHSA-vx2m-gpq4-8j5q","loopx"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T16:11:57.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}