Vendor
LoopX serve-status (v0.0.1 to v0.4.4) uses a permissive wildcard CORS policy on unauthenticated local HTTP endpoints, allowing any website to exfiltrate private control-plane state and markdown documentation from local developer environments.