CVE-2026-88061: career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
career-ops local web dashboardto a version that resolves this vulnerability.Fixed in 0.8.0Patch 0.8.0
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects deployments of the local web dashboard from the source project before version 0.8.0. npm installations are unaffected because the web/ dashboard is excluded from the published package.
What must an attacker be able to do to exploit this?
If the dashboard is running locally, an attacker can use a malicious page opened in another browser tab to send cross-origin requests to it. If the dashboard is bound to a non-loopback address, an attacker on the local network can send requests directly.
What is the impact of successful exploitation?
The exposed API routes can spawn commands and write user files without authentication. Successful exploitation results in command execution as the user running the dashboard.
What should teams do if they cannot immediately update?
Avoid running the affected web dashboard, especially with a non-loopback network binding. This removes the direct local-network exposure and avoids having the vulnerable API available to browser-based cross-origin requests.
How can I determine whether remediation is needed?
Check whether you are using the source-project web/ dashboard and whether its version is earlier than 0.8.0. npm-only installations do not require remediation for this issue.