{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/loopx/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:loopx:loopx:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-108372"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["loopx (\u003e= 0.0.1, \u003c 0.4.5)"],"_cs_severities":["high"],"_cs_tags":["info-disclosure","cors","loopx","cve-2026-108372"],"_cs_type":"advisory","_cs_vendors":["LoopX"],"content_html":"\u003cp\u003eLoopX versions prior to 0.4.5 contain a security vulnerability in the \u003ccode\u003eserve-status\u003c/code\u003e component where the HTTP server issues an \u003ccode\u003eAccess-Control-Allow-Origin: *\u003c/code\u003e header on all responses, including sensitive read-only endpoints. Because the service binds to well-known local ports (8765 and 8766) and is frequently configured to run persistently as a background agent via \u003ccode\u003elaunchd\u003c/code\u003e on macOS or equivalent startup mechanisms on other platforms, it creates a persistent, machine-wide attack surface.\u003c/p\u003e\n\u003cp\u003eAn attacker can leverage this misconfiguration by enticing a user to visit a malicious website, which then issues unauthorized cross-origin \u003ccode\u003efetch()\u003c/code\u003e requests to \u003ccode\u003elocalhost\u003c/code\u003e. This allows the attacker to read the \u003ccode\u003estatus.json\u003c/code\u003e file (revealing project paths and task history) and fetch the content of any \u003ccode\u003e.md\u003c/code\u003e or \u003ccode\u003e.markdown\u003c/code\u003e file within the registered goal repositories. While write endpoints are protected by appropriate origin checks, the read surface is sufficient to exfiltrate private design notes, handoff documentation, and environment context without user interaction or authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe user installs and runs \u003ccode\u003eloopx serve-status\u003c/code\u003e as a persistent background service (e.g., via \u003ccode\u003escripts/macos-dashboard-launchagent.sh\u003c/code\u003e), binding the service to \u003ccode\u003e127.0.0.1:8766\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker hosts a malicious website containing a cross-origin \u003ccode\u003efetch()\u003c/code\u003e script targeting \u003ccode\u003ehttp://127.0.0.1:8766/status.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe victim opens the attacker-controlled website in their local browser.\u003c/li\u003e\n\u003cli\u003eThe browser automatically executes the malicious script, which makes an unauthenticated GET request to the local LoopX service.\u003c/li\u003e\n\u003cli\u003eThe LoopX service returns the JSON status payload along with the header \u003ccode\u003eAccess-Control-Allow-Origin: *\u003c/code\u003e, which the browser accepts due to the permissive CORS policy.\u003c/li\u003e\n\u003cli\u003eThe attacker's script parses the returned JSON to identify \u003ccode\u003egoal_id\u003c/code\u003es and local repository paths.\u003c/li\u003e\n\u003cli\u003eThe attacker's script iterates through the goal list, issuing additional GET requests to \u003ccode\u003ehttp://127.0.0.1:8766/review-material\u003c/code\u003e to exfiltrate the contents of private markdown files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized exfiltration of sensitive information stored in developer environments. This includes project task history, local directory structures, and confidential design or handoff documentation. Because the service is often persistent and uses hardcoded default ports, the impact is sustained across user login sessions, affecting any developer running vulnerable versions of the LoopX toolset.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all LoopX installations to version 0.4.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, restrict access to the LoopX control-plane ports (8765/8766) via host-based firewall rules to prevent cross-origin traffic originating from external browser contexts.\u003c/li\u003e\n\u003cli\u003eAudit local file repositories associated with LoopX for sensitive credentials or keys that may have been accessible via the \u003ccode\u003e/review-material\u003c/code\u003e endpoint prior to patching.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T20:10:44Z","date_published":"2026-10-19T20:10:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-loopx-cors-exposure/","summary":"LoopX serve-status (v0.0.1 to v0.4.4) uses a permissive wildcard CORS policy on unauthenticated local HTTP endpoints, allowing any website to exfiltrate private control-plane state and markdown documentation from local developer environments.","title":"LoopX serve-status CORS Misconfiguration and Information Disclosure","url":"https://feed.craftedsignal.io/briefs/2026-10-loopx-cors-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Loopx","version":"https://jsonfeed.org/version/1.1"}