EUVD-2026-54920
GHSA-rq3v-mj3j-qv4c
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector for local API targeting via DNS rebinding; user interaction required to visit attacker page; low confidentiality with no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
AnalysisAI
Server-side request forgery in LosslessCut's experimental built-in HTTP API (versions up to 3.69.0) allows an adjacent-network attacker to abuse the unauthenticated local API by exploiting missing Host and Origin header validation. The missing controls enable DNS rebinding and cross-site request forgery techniques to issue unauthorized API calls through a victim's running LosslessCut instance, yielding limited confidentiality impact. A publicly available proof-of-concept exists per the exploit reference, but no active exploitation has been confirmed - the vulnerability is not listed in CISA KEV, and exploitation is gated behind a non-default experimental CLI flag that must be explicitly enabled by the user.
Technical ContextAI
LosslessCut (CPE: cpe:2.3:a:mifi:lossless-cut:*:*:*:*:*:*:*:*) is an Electron-based desktop video editor that optionally exposes a local HTTP API server implemented in TypeScript at src/main/httpServer.ts. The root cause class is CWE-918 (Server-Side Request Forgery): prior to patching, the API server accepted inbound requests without validating the HTTP Host or Origin headers, enabling two distinct attack classes. First, DNS rebinding - an attacker registers a domain that initially resolves to their own IP, tricks the victim into loading a page from it, then re-binds DNS to 127.0.0.1, making attacker JavaScript same-origin with the local API. Second, CSRF - browsers always send an Origin header on cross-origin and POST requests, but non-browser HTTP clients do not; without Origin validation, web pages could issue API calls on the victim's behalf. The patch (commit 260802348955231442c4bae6c2d9d8ede947af0a) introduces an isRequestAllowed() middleware that enforces a localhost/127.0.0.1/[::1] Host allowlist matched against the configured port, and rejects any request carrying an Origin header - blocking both DNS rebinding and browser-sourced CSRF vectors simultaneously. The maintainer's note that this touches NTLM behavior under an experimental CLI flag suggests the HTTP API may proxy or relay certain Windows authentication exchanges, which is the specific SSRF surface being protected.
RemediationAI
The primary fix is applying the upstream patch commit 260802348955231442c4bae6c2d9d8ede947af0a (https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0a), which adds Host and Origin header validation middleware to the HTTP API. A specific patched release version number was not confirmed from the available data - only the commit hash is available - so users should update to the latest available release from the project repository (https://github.com/mifi/lossless-cut/) and verify the patch commit is included. As an immediate compensating control, the most effective mitigation is to avoid enabling the experimental HTTP API CLI flag entirely; this eliminates the attack surface with no functional trade-off for users who do not depend on the API. For users who require the API and cannot patch immediately, avoiding browsing to untrusted websites while the API is running reduces CSRF exposure, since browsers send Origin on cross-origin requests. OS-level firewall rules restricting inbound connections to the API port to loopback-only traffic add a modest additional barrier against adjacent-network pivoting but do not address the browser-based CSRF vector.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today