EUVD-2026-54715Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Browser-proxied network reach with no auth on loopback (AV:N/PR:N), only a page visit needed (UI:R), and pivot from browser into host command execution justifies scope change with full C/I/A loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1:<random port> (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server - the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with permission_presets.bash=true, shut down the service, and exfiltrate chat history and account PII - with no user interaction beyond opening the page. Version 1.1.3 patches the issue.
AnalysisAI
Cross-origin request forgery leading to remote code execution in OpenYak before 1.1.3 lets any malicious webpage a user visits drive the desktop backend's loopback HTTP API (typically 127.0.0.1:19141) to run arbitrary shell commands on the host, terminate the service, and steal chat history and account PII. The local API ships with no Origin validation, no loopback authentication, no Content-Type enforcement, and a wildcard CORS policy, so the victim's browser is abused as a proxy that defeats OS-level network isolation. No public exploit identified at time of analysis; the flaw is fixed in version 1.1.3.
Technical ContextAI
OpenYak is a local-first agent runtime for tool-using models packaged with a desktop workspace; the desktop backend exposes a REST/HTTP control API bound to loopback on a randomized port. The root cause is CWE-94 (Code Injection): the build agent honors a permission preset (permission_presets.bash=true) that allows shell command execution, and the surrounding HTTP layer performs no server-side Origin checking, no per-request authentication token, and applies a permissive wildcard CORS policy. Because browsers freely allow cross-origin requests to loopback and the server neither rejects foreign Origins nor requires a non-simple Content-Type/preflight, a remote page can reach and command a service that developers assume is protected simply by being bound to 127.0.0.1. The affected component is identified in CPE data as cpe:2.3:a:openyak:openyak (all versions prior to the fix).
RemediationAI
Vendor-released patch: 1.1.3 - upgrade OpenYak to 1.1.3 or later, which adds Origin validation, loopback authentication, Content-Type enforcement, and removes the wildcard CORS policy (see https://github.com/openyak/openyak/security/advisories/GHSA-ccxp-q2w5-27jw). If immediate patching is not possible, disable the build agent's shell capability by setting permission_presets.bash=false to remove the RCE primitive (this disables legitimate bash tool use), and avoid running OpenYak while browsing untrusted sites; where feasible, use host firewall rules or a local proxy to restrict which processes can reach the backend's loopback port, accepting that a randomized port makes static rules brittle. Shutting OpenYak down entirely when not in active use eliminates the exposure window at the cost of availability.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today