DNS Rebinding Vulnerability in Rojo's HTTP API
CVE-2026-97875

8.1HIGH

Key Information:

Vendor

Rojo-rbx

Status
Rojo
Vendor
CVE Published:
25 September 2026

What is CVE-2026-97875?

Rojo's HTTP API is susceptible to DNS rebinding due to a lack of Host/Origin header validation. This vulnerability allows attackers to exploit the API, providing them the capability to read project source files, inject malicious code into disk files, and execute local programs without user intervention, merely by visiting a crafted webpage. This poses significant risks for user data integrity and system security.

Affected Version(s)

rojo 0 < 7.7.0

References

https://github.com/rojo-rbx/rojo/pull/1270
patch
https://rustsec.org/advisories/RUSTSEC-2026-0279.html
vendor-advisory
https://osv.dev/vulnerability/RUSTSEC-2026-0279
related

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aiden Mohan (https://github.com/AidenMohan)
.