Cross-Origin Vulnerability in SharpEmu Emulator for PlayStation 5
CVE-2026-92704

8.3HIGH

Key Information:

Vendor

Sharpemu

Status
Sharpemu
Vendor
CVE Published:
4 November 2026

What is CVE-2026-92704?

An experimental PlayStation 5 emulator, SharpEmu, contains a security flaw in its debugger frontend tooling prior to version 0.0.3-release.3-patch.1. This vulnerability arises due to the frontend exposing an HTTP API at 127.0.0.1:8765 without proper authentication mechanisms. The API endpoints allow for unauthenticated cross-origin requests, enabling attackers to execute commands and gain control over the emulated environment. Particularly, the /api/launch endpoint permits the selection of emulator paths without validation, potentially leading to privilege escalation and execution of arbitrary binaries. This issue underscores the importance of implementing robust security practices for local services and is addressed in the latest patch release.

Affected Version(s)

sharpemu < 0.0.3-release.3-patch.1

References

https://github.com/sharpemu/sharpemu/security/advisories/...
x_refsource_CONFIRM
https://github.com/sharpemu/sharpemu/pull/858
x_refsource_MISC
https://github.com/sharpemu/sharpemu/commit/3831f3c407c54...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.