CVE-2026-108372: loopx >= 0.0.1, < 0.4.5

Affected technology

loopx · >= 0.0.1, < 0.4.5
huangruiteng

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.