## LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-108372
- 公開日時: 2026-10-19T16:11:57.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-vx2m-gpq4-8j5q)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-vx2m-gpq4-8j5q

影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5
Summary loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…