CVE-2026-53656

Katalog CVE

CVSS 6.3 · Medium EPSS 0,12%

Kerentanan Origin Validation Error. Skor CVSS 3.1 6.3 (Medium) menurut github.com.

Deskripsi (NVD)

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks. The allowed_origins configuration and FIFTYONE_ALLOWED_ORIGINS environment variable now make cross-origin access explicit, while the default policy is same-origin. This issue is fixed in version 1.17.0.

Rincian

Terbit di NVD

21 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

6.3 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/voxel51/fiftyone/commit/6c4fa1b27bf53e4ba567742ffd20d033af7b9e64
• https://github.com/voxel51/fiftyone/commit/7c5b92eec5c7c0210c0c8134351ced77d2800ae0
• https://github.com/voxel51/fiftyone/releases/tag/v1.17.0
• https://github.com/voxel51/fiftyone/security/advisories/GHSA-q78p-hj9h-5466