Improper Request Authentication in Lavish Editor by a Known Vendor
CVE-2026-102344
8.1HIGH
What is CVE-2026-102344?
The Lavish Editor, specifically versions prior to 0.1.43, is susceptible to an improper authentication vulnerability due to its loopback HTTP server not validating Host and Origin headers. This oversight allows attackers to exploit DNS rebinding techniques. By sending specially crafted requests to a running Lavish server via a malicious website, unauthorized users can gain access to sensitive files by obtaining deterministic session keys. The flaw enables them to disclose any server-readable file without an active session and also interact with the agent session through crafted prompts. The issue has been addressed in version 0.1.43.
Affected Version(s)
lavish-axi < 0.1.43