EUVD-2026-64145
GHSA-q78p-hj9h-5466
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack originates from a remote web page (AV:N); server is unauthenticated (PR:N); victim must visit a page (UI:R); read scope extends to local filesystem beyond server (S:C); arbitrary file read achievable (C:H).
Primary rating from Vendor (https://github.com/voxel51/fiftyone).
CVSS VectorVendor: https://github.com/voxel51/fiftyone
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 pypi packages depend on fiftyone (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 1.17.0.
DescriptionCVE.org
Impact
The FiftyOne App/API server (fiftyone/server/app.py) and the /media route (fiftyone/server/routes/media.py) unconditionally set a permissive CORS header (Access-Control-Allow-Origin: *) on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website a user visits to make cross-origin requests to that user's running FiftyOne server and read the responses.
Combined with the unauthenticated /media endpoint - which serves files from the local filesystem by path - the wildcard CORS policy turns a local-only file read into a remotely exploitable, drive-by data exfiltration vulnerability. A malicious web page can silently issue requests such as http://localhost:5151/media?filepath=/etc/passwd and read arbitrary files accessible to the server process (SSH keys, cloud credentials, .env files, dataset media, etc.), then exfiltrate them to an attacker-controlled endpoint.
The victim only needs to have a FiftyOne server running locally and visit a malicious page - no clicks or other interaction are required. Browsers that have shipped Private Network Access / local-network-access protections (e.g. Chromium 142+) mitigate this for some users, but Safari and Firefox do not yet, so the attack remains viable in common configurations.
Who is impacted: any user running FiftyOne (the open-source, embedded App server) locally while also browsing the web.
Not affected: media stored in cloud buckets, which is served via signed URLs on a separate origin.
Patches
Fixed in FiftyOne 1.17.0. The hard-coded Access-Control-Allow-Origin: * has been removed and the server now responds same-origin only by default, which covers local desktop usage and the supported notebook integrations (each served through a same-origin proxy or iframe).
Cross-origin access is now opt-in via a new allowed_origins config option (environment variable FIFTYONE_ALLOWED_ORIGINS), an explicit comma-separated list of trusted origins, e.g.:
export FIFTYONE_ALLOWED_ORIGINS='https://app.example.com,http://localhost:3000'The literal value * restores the legacy wildcard behavior for users who explicitly require it and emits a warning.
Users should upgrade to FiftyOne 1.17.0 or later.
Workarounds
In affected versions there is no configuration flag to disable the wildcard CORS header without upgrading. Until you can upgrade:
- Do not run the FiftyOne App server while browsing untrusted websites.
- Keep the App server bound to
localhost(the default) and avoid exposing it on a network interface. - Use a browser that enforces Private Network Access protections.
Resources
- OWASP A01:2025 - Broken Access Control: https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/
AnalysisAI
Drive-by local filesystem exfiltration in FiftyOne versions below 1.17.0 allows any malicious website to silently read arbitrary files from a victim's machine. The FiftyOne App server unconditionally returns Access-Control-Allow-Origin: * on all responses, and the unauthenticated /media endpoint serves local filesystem files by path - together these let JavaScript on any visited webpage fetch files such as SSH keys, cloud credentials, or .env files from localhost:5151 and relay them to an attacker-controlled server. No public exploit (KEV or confirmed POC) is identified at time of analysis, but the attack requires no special tooling and is trivially reproducible in Safari and Firefox, which lack Private Network Access protections.
Technical ContextAI
FiftyOne (pkg:pip/fiftyone) is an open-source computer vision dataset management framework by Voxel51 that embeds a local HTTP application server (Starlette/ASGI) serving its web UI on localhost:5151. The root cause is CWE-346 (Origin Validation Error): fiftyone/server/app.py applied a blanket CORSMiddleware with allow_origins=["*"], and fiftyone/server/routes/media.py hardcoded Access-Control-Allow-Origin: * in every response header, with no validation of the requesting origin. The /media endpoint accepts a filepath query parameter and serves the file directly from the local filesystem without any authentication or path restriction. Because browsers enforce CORS only for the receiving context - permitting cross-origin reads whenever the server explicitly opts in - the wildcard header instructs the browser to expose the full response body to any requesting origin, including malicious third-party pages. The commit diff confirms both hardcoded headers were removed in the fix (commit 7c5b92eec5c7c0210c0c8134351ced77d2800ae0), replacing them with an opt-in allowed_origins configuration defaulting to same-origin only.
RemediationAI
Upgrade to FiftyOne 1.17.0 or later via pip install --upgrade fiftyone. The fix removes the hardcoded wildcard CORS header from both fiftyone/server/app.py and fiftyone/server/routes/media.py, defaulting the server to same-origin-only responses - sufficient for local desktop use and supported notebook integrations. Patch commit: https://github.com/voxel51/fiftyone/commit/7c5b92eec5c7c0210c0c8134351ced77d2800ae0. If cross-origin access is legitimately required (e.g., embedding the App in a trusted host), set the environment variable FIFTYONE_ALLOWED_ORIGINS to a comma-separated list of explicitly trusted origins (e.g., https://app.example.com) rather than '*'; using '*' restores the vulnerable behavior and emits a warning. If immediate upgrade is not possible, do not run the FiftyOne App server while browsing untrusted websites; keep the server bound to localhost (the default) rather than exposing it on external interfaces; and prefer Chromium 142+ which enforces Private Network Access restrictions that block this class of localhost-fetch attack. Note that binding to localhost alone is insufficient - the CORS wildcard still permits exfiltration through a browser running on the same machine.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Same weakness CWE-346 – Origin Validation Error
View allShare
External POC / Exploit Code
Leaving vuln.today