Eliza
Monthly
Information disclosure in the elizaOS Eliza 2.0.3-beta.7 Electrobun desktop build causes the app's highest-privilege OWNER bearer token to be embedded in HTML documents served by its local static server, so a cross-origin website that can read those responses, or any local process able to read the served page, can capture the credential. Exploitation requires the victim to load attacker-controlled content and depends on the static server returning a permissive Access-Control-Allow-Origin header, which is why the assessed severity is moderate and conditional rather than an emergency. A public PoC reference exists in the upstream issue tracker; it is not verified as working exploit code, and a vendor fix is available as the commit referenced by PR #33142.
Information disclosure in the elizaOS Eliza 2.0.3-beta.7 Electrobun desktop build causes the app's highest-privilege OWNER bearer token to be embedded in HTML documents served by its local static server, so a cross-origin website that can read those responses, or any local process able to read the served page, can capture the credential. Exploitation requires the victim to load attacker-controlled content and depends on the static server returning a permissive Access-Control-Allow-Origin header, which is why the assessed severity is moderate and conditional rather than an emergency. A public PoC reference exists in the upstream issue tracker; it is not verified as working exploit code, and a vendor fix is available as the commit referenced by PR #33142.