Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Description: OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.
The CVSS Base Score is a score from 0 to 10 that represents the intrinsic severity of a vulnerability. A higher score indicates greater severity.
Database CWE: v4.18
CWE-94: Improper Control of Generation of Code ('Code Injection') ↗
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-306: Missing Authentication for Critical Function ↗
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-346: Origin Validation Error ↗
The product does not properly verify that the source of data or communication is valid.
CWE-352: Cross-Site Request Forgery (CSRF) ↗
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains ↗
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Fonte: MITRE CWE
The EPSS (Exploit Prediction Scoring System) is a score from 0 to 1 that indicates the probability that a vulnerability will be exploited in the real world in the next 30 days. A higher value indicates a greater likelihood of exploitation.
EPSS Score not available for this CVE.
The Percentile indicates how much higher this vulnerability's EPSS score is compared to all other vulnerabilities in the EPSS database. For example, a percentile of 0.90 (90%) means that 90% of vulnerabilities have an EPSS score equal to or lower than the current one.
Percentile not available for this CVE.
*Data updated as of: N/A
The CISA KEV Catalog lists vulnerabilities that have been actively exploited in the real world. If a CVE is present in this catalog, it indicates that the threat is immediate and mitigation should be a top priority.
CVE CVE-2026-46409 is not present in the CISA KEV Catalog. This indicates that it is not currently classified by CISA as an actively exploited vulnerability.
No articles present on Red Hot Cyber.
No results found on GitHub for this CVE.