CVE-2026-46409
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1:<random port> (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with permission_presets.bash=true, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| openyak | openyak | < 1.1.3 | affected |
Weaknesses
- CWE-94: CWE-94: Improper Control of Generation of Code ('Code Injection')
- CWE-306: CWE-306: Missing Authentication for Critical Function
- CWE-346: CWE-346: Origin Validation Error
- CWE-352: CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-942: CWE-942: Permissive Cross-domain Policy with Untrusted Domains
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.