DNS rebinding vulnerability in rojo serve HTTP API

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

Source published

25 Sep 2026 10:48:47 UTC

Source modified

25 Sep 2026 16:39:44 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

Source published

Sep 25, 2026, 10:48:47 AM (timezone not stated)

Source modified

Sep 25, 2026, 4:39:44 PM (timezone not stated)

Observed here

11 Nov 2026 17:07:04 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

Source published

25 Sep 2026 11:17:16 UTC

Source modified

30 Sep 2026 17:32:07 UTC

Observed here

25 Oct 2026 16:19:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 74b3a70d-cca6-4d34-9789-e83b222ae3be · Secondary · 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Rojo's `rojo serve` command starts an unauthenticated HTTP API on localhost (default port 34872) with no `Host` or `Origin` header validation. While direct cross-origin `fetch()` requests from a malicious website are blocked by the browser's default CORS policy, an attacker can use DNS rebinding to bypass this restriction entirely. The serve API is a two-way sync protocol. Once a DNS rebind is established, a malicious webpage visited by a developer running `rojo serve` can, without any further user interaction: - **Read the full project source:** `GET /api/rojo` returns the session ID, root instance ID, and project name. `GET /api/read/{id}` enumerates the complete instance tree including all script contents, exposing proprietary game logic, configuration, and any secrets embedded in source files. - **Write to project files on disk:** `POST /api/write` pushes changes back through Rojo's sync pipeline, allowing an attacker to inject arbitrary Lua into the developer's project. If the developer then publishes their game, the injected code executes on every player's client — a supply chain attack vector. - **Launch local programs:** `POST /api/open/{id}` calls the OS-level `opener::open()` function, which invokes the platform's default handler (`open` on macOS, `xdg-open` on Linux, `start` on Windows) for the target file. Exploitation requires only that `rojo serve` is running (the standard Roblox development workflow) and that the developer visits an attacker-controlled webpage in any browser on the same machine. The port is a fixed well-known default (34872), there is no authentication, and no user interaction is needed beyond the initial page visit. The flaw was corrected in [#1270](https://github.com/rojo-rbx/rojo/pull/1270), which adds `Host`/`Origin` header validation to reject cross-origin requests, gates `/api/open` to loopback clients regardless of validated origin, and emits a warning when the server binds to a non-loopback address Reported by [Aiden Mohan](https://github.com/AidenMohan).

Source published

2 Jun 2026 12:00:00 UTC

Source modified

25 Sep 2026 12:00:03 UTC

Observed here

24 Oct 2026 13:19:54 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N