elizaOS Eliza CVE-2026-124587

Applies specifically to the elizaOS Electrobun desktop platform build whose local static server (packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts) injects the OWNER bearer token into served HTML documents. Remote exploitation requires (1) the static server to serve the token-bearing index document and (2) a permissive Access-Control-Allow-Origin response header that lets an arbitrary cross-origin website read the body - per the PR, 'any Access-Control-Allow-Origin header would let an arbitrary website fetch the index page and extract the credential.' Exploitation is LIMITED by required passive user interaction (the victim must load attacker-controlled content, UI:P), by dependence on that CORS exposure, and by the fact that only this desktop/static-server path is affected; a local process able to read the served page can also obtain the token. The documented remediation is applying the patch (token removed from the HTML inject and delivered only via the typed RPC bridge).

This is a moderate, conditional information-disclosure issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N, score 5.3, E:P) indicates a network-reachable, unauthenticated flaw requiring only passive user interaction and yielding limited confidentiality impact. The source-code evidence sharpens this: the Electrobun desktop build's static server embedded the OWNER-level bearer token directly into served HTML, so 'any Access-Control-Allow-Origin header would let an arbitrary website fetch the index page and extract the credential' (elizaOS/eliza#33034) - meaning real-world exploitation hinges on a permissive CORS response header and on a victim loading attacker-controlled content, which argues the attack complexity is higher in practice than the input's AC:L suggests. Not listed in CISA KEV and no EPSS score was provided, so there is no signal of active or widespread exploitation; the only exploit signal is a public issue reference, not verified working exploit code. The vendor/VulDB decision label is 'this_month' (not act_now/emergency), consistent with a patch-on-normal-cadence priority. Note the tension on impact: VulDB rated confidentiality Low, yet the leaked item is described by the project as 'the app's highest-privilege credential,' so the business impact of a successful leak could exceed the C:L rating - verify token scope against the local API's capabilities.

On a machine running the elizaOS Electrobun desktop app, the local static server returns an index document with the OWNER bearer token baked into its HTML. A user is lured to a malicious web page that issues a cross-origin fetch to the local server; if a permissive Access-Control-Allow-Origin header is present, the attacker's script reads the response and extracts the credential. A public PoC reference exists (GitHub issue #33034) but is not verified as working exploit code.