Permissive Cross-domain Policy with Untrusted Domains Affecting github.com/bishopfox/joro/internal/api package, versions <1.1.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Permissive Cross-domain Policy with Untrusted Domains vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMBISHOPFOXJOROINTERNALAPI-17912614
- published9 Jul 2026
- disclosed8 Jul 2026
- creditUnknown
Introduced: 8 Jul 2026
CVE-2026-53649 (opens in a new tab)How to fix?
Upgrade github.com/BishopFox/joro/internal/api to version 1.1.1 or higher.
Overview
Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains through the unauthenticated local API exposed in proxy mode, which accepts cross-origin requests due to a permissive CORS policy and lack of authentication. An attacker can achieve execution of arbitrary code as the operator's user by tricking the operator into visiting a malicious web page, which then uploads a crafted plugin and triggers a restart via the operator's browser.