CVSS 4.0
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, само при определена конфигурация или състояние на системата, без вход и след действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.
Засегнати продукти
- santifer career-ops: < 0.8.0
Вид слабост
История
- 10 септември 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-88061
- https://nvd.nist.gov/vuln/detail/CVE-2026-88061
- https://github.com/career-ops-hq/career-ops/security/advisories/GHSA-wpqw-whgf-gr4g
- https://github.com/career-ops-hq/career-ops/commit/b3974e6104d83c2714fd0d071898a7c7b9f68726
- https://github.com/career-ops-hq/career-ops/releases/tag/web-v0.8.0