ActivityWatch vulnerable to DNS rebinding attack
Priority HIGH 76CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-290.
Summary
ActivityWatch open-source automated time tracker. Versions prior to 0.12.0b2 are vulnerable to DNS rebinding attacks. This vulnerability impacts everyone running ActivityWatch and gives the attacker full access to the ActivityWatch REST API. Users should upgrade to v0.12.0b2 or later to receive a patch. As a workaround, block DNS lookups that resolve to 127.0.0.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01282 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed activitywatch (ActivityWatch): 0.12.0b2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ActivityWatch | activitywatch | before 0.12.0b2 | 0.12.0b2 | Patch available | CNA |
- activitywatch VendorActivityWatch Affected before 0.12.0b2 Fixed in 0.12.0b2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:activitywatch:activitywatch:*:*:*:*:*:*:*:* | before 0.12.0 | Vulnerable | ActivityWatch |
| cpe:2.3:a:activitywatch:activitywatch:0.12.0:beta1:*:*:*:*:*:* | 0.12.0 beta1 | Vulnerable | ActivityWatch |
- cpe:2.3:a:activitywatch:activitywatch:*:*:*:*:*:*:*:* Versions before 0.12.0 Vulnerable ·ActivityWatch
- cpe:2.3:a:activitywatch:activitywatch:0.12.0:beta1:*:*:*:*:*:* Versions 0.12.0 beta1 Vulnerable ·ActivityWatch
Remediation
- Fix · CNA activitywatch (ActivityWatch) Fixed in 0.12.0b2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31149
References
More Activitywatch vulnerabilities
- TI-2021-12360 Activity Watch vulnerable to command execution on macOS via printAppTitle.scpt CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences