Career Ops
Monthly
Unauthenticated command execution is possible against the career-ops local web dashboard (web/) because its /api routes - which spawn child processes and write user files - accepted cross-origin requests without validating the Sec-Fetch-Site or Origin header, and without enforcing loopback-only binding. Two independent attack paths exist: a drive-by CSRF where any malicious page in another browser tab POSTs silently to http://localhost:<port>/api, and a LAN-direct path if the dev server is bound to 0.0.0.0. Fixed in web-v0.8.0; the published npm package is unaffected because the web/ directory is excluded from it. No public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated command execution is possible against the career-ops local web dashboard (web/) because its /api routes - which spawn child processes and write user files - accepted cross-origin requests without validating the Sec-Fetch-Site or Origin header, and without enforcing loopback-only binding. Two independent attack paths exist: a drive-by CSRF where any malicious page in another browser tab POSTs silently to http://localhost:<port>/api, and a LAN-direct path if the dev server is bound to 0.0.0.0. Fixed in web-v0.8.0; the published npm package is unaffected because the web/ directory is excluded from it. No public exploit or CISA KEV listing exists at time of analysis.