LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…

GitHub Advisory Databaseで読む