Openyak
Monthly
Cross-origin request forgery leading to remote code execution in OpenYak before 1.1.3 lets any malicious webpage a user visits drive the desktop backend's loopback HTTP API (typically 127.0.0.1:19141) to run arbitrary shell commands on the host, terminate the service, and steal chat history and account PII. The local API ships with no Origin validation, no loopback authentication, no Content-Type enforcement, and a wildcard CORS policy, so the victim's browser is abused as a proxy that defeats OS-level network isolation. No public exploit identified at time of analysis; the flaw is fixed in version 1.1.3.
Cross-origin request forgery leading to remote code execution in OpenYak before 1.1.3 lets any malicious webpage a user visits drive the desktop backend's loopback HTTP API (typically 127.0.0.1:19141) to run arbitrary shell commands on the host, terminate the service, and steal chat history and account PII. The local API ships with no Origin validation, no loopback authentication, no Content-Type enforcement, and a wildcard CORS policy, so the victim's browser is abused as a proxy that defeats OS-level network isolation. No public exploit identified at time of analysis; the flaw is fixed in version 1.1.3.