Rojo EUVD-2026-86991

Requires the victim to be actively running 'rojo serve' (default bind localhost, default port 34872) with the pre-patch build that performs no Host/Origin header validation and does not gate /api/open to local clients. The developer must, during that session, visit an attacker-controlled webpage in a browser on the same machine; the attacker must control DNS to perform the rebinding. Limiting factors: exploitation is bounded to machines running the dev server at the moment of the visit, requires user interaction (visiting the page) and attacker DNS infrastructure, and is neutralized by the patched version's Host/Origin validation, the --allowed-hosts / serveAllowedHosts allowlist, or binding away from network-reachable addresses.

The NVD CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.1 High) is well-supported by the description: a network-reachable attack (via a browser the victim controls) with no authentication, requiring only that the developer visit a malicious page (UI:R). The impact is understated by the 'Information Disclosure' tag - the description confirms the attacker can not only read all project source (C:H) but also write arbitrary code to disk (I:H) and launch local programs via opener::open(), which is effectively local code execution on the developer's machine. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation; absence of these signals is expected for a niche developer tool and does not lower the technical severity. The one moderating factor is that DNS rebinding requires attacker-controlled DNS infrastructure and a victim actively running 'rojo serve' during a browsing session - realistic for the target audience but not a mass-exploitable internet-facing service. This is a genuinely serious flaw for affected users (read/write/RCE with only a page visit) rather than a high-CVSS-but-low-impact issue, but its real-world blast radius is bounded by the small, developer-only install base.

A Roblox developer runs 'rojo serve' (default localhost:34872) during a project session and, in the same browser, visits a malicious webpage. The page uses DNS rebinding to bypass the same-origin policy and reach the unauthenticated local API, then reads the entire project source, writes attacker-controlled code into the project files, and invokes /api/open to launch a local program - achieving code execution with no interaction beyond the page visit. No public exploit code is identified at time of analysis, though the technique (DNS rebinding against an unvalidated local HTTP API) is well-documented.