Octoally
Monthly
Information disclosure in OctoAlly (ai-genius-automations/octoally) through version 1.0.87 lets remote attackers manipulate the path argument handled in server/src/index.ts to expose data the server should not return. Per the CVSS vector (PR:N, AV:N) no authentication is required, and because pre-1.0.88 builds default to binding all interfaces with no Host or Origin validation, exposure is reachable either directly over the network or through a victim's browser via DNS rebinding or cross-origin requests against an otherwise loopback-only deployment. Publicly available exploit code exists (upstream issue #24) and the vendor shipped a fix in 1.0.88; no confirmed active exploitation (CISA KEV) has been reported, and the CVSS 4.0 base score is 6.9 with E:P reflecting proof-of-concept maturity rather than in-the-wild use.
Information disclosure in OctoAlly (ai-genius-automations/octoally) through version 1.0.87 lets remote attackers manipulate the path argument handled in server/src/index.ts to expose data the server should not return. Per the CVSS vector (PR:N, AV:N) no authentication is required, and because pre-1.0.88 builds default to binding all interfaces with no Host or Origin validation, exposure is reachable either directly over the network or through a victim's browser via DNS rebinding or cross-origin requests against an otherwise loopback-only deployment. Publicly available exploit code exists (upstream issue #24) and the vendor shipped a fix in 1.0.88; no confirmed active exploitation (CISA KEV) has been reported, and the CVSS 4.0 base score is 6.9 with E:P reflecting proof-of-concept maturity rather than in-the-wild use.