massCode CVE-2026-114574

Requires the massCode desktop app's Local HTTP Service to be running on the victim's machine (bound to the loopback port) AND the victim to actively load an attacker-controlled web page (UI:P). The pre-patch service shipped with permissive CORS ('@elysiajs/cors') and no API-token authentication, allowing a cross-origin or DNS-rebinding browser request to read snippet data. Limiting factors: no exploitation without the local service enabled, no authentication token is bypassed because none existed pre-fix, impact is confined to low-sensitivity information disclosure (VC:L; no integrity/availability effect), and the attack cannot proceed without victim browser interaction. The fix rebinds to 127.0.0.1, removes CORS, and adds Bearer-token auth, closing the cross-origin/rebinding path.

This is a genuinely low-priority issue, and the multiple signals agree rather than conflict. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L, score 2.1 Low) describes a network-reachable but passive-user-interaction attack yielding only LOW confidentiality impact and no integrity or availability impact (VI:N/VA:N) - consistent with CWE-200 information disclosure. A public PoC exists (E:P in the vector and the description's statement that 'the exploit has been disclosed publicly'), which raises real-world likelihood somewhat, but this is NOT the same as active exploitation: there is NO CISA KEV listing and NO EPSS score provided in the input, so widespread or automated exploitation cannot be inferred. The source-code evidence clarifies the true nature of the bug: the patch removes the permissive '@elysiajs/cors' dependency, rebinds the local service from 'localhost' to '127.0.0.1' (a DNS-rebinding hardening), and introduces a Bearer API-token requirement - indicating the flaw is a cross-origin/DNS-rebinding read of the app's local HTTP API by a malicious webpage, not a direct internet-exposed service. Net assessment: real but minor; the AV:N label overstates the practical reach because exploitation depends on the victim running the local service and visiting an attacker-controlled page (UI:P). EPSS is absent, so no probabilistic exploitation estimate is available - treat urgency as low absent further vendor signal.

A massCode user has the local HTTP snippet API running (default port, e.g. 4321) and visits an attacker-controlled web page. Because the service lacked CORS restrictions and token authentication, the page issues cross-origin (or DNS-rebinding) requests to the local API and reads back the user's stored snippet data. A public proof-of-concept for this technique has been disclosed.