CVE-2026-97875: DNS rebinding vulnerability in rojo serve HTTP API
Published Sep 25, 2026
·Updated
Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.
Affected Software
1 affected component
Rojo Rojo
Event History
Sep 25, 2026
CVE Published
via MITRE·10:48 AM
Data Sourced
via MITRE·10:48 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems running Rojo's "rojo serve" HTTP API are exposed. The API uses port 34872 by default.
2
What does an attacker need to exploit the vulnerability?
An attacker can use a malicious webpage in a DNS rebinding attack. No privileges on the target system are required; the described user interaction is visiting the page.
3
What could exploitation allow on an affected machine?
An attacker could read all project source, write malicious code to files on disk, and launch local programs through opener::open().