Read the docs
TI-2026-38693 Aliases CVE-2026-53649GHSA-xqhv-chqm-fhcc

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Priority MEDIUM 43CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306, CWE-352 and CWE-434.

Summary

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed joro (BishopFox): 1.1.1github.com/BishopFox/joro (Go): 0.0.0-20260601151442-5c0ca35db828

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BishopFoxjorobefore 1.1.11.1.1Patch availableCNA
—github.com/BishopFox/joro (Go)before 0.0.0-20260601151442-5c0ca35db8280.0.0-20260601151442-5c0ca35db828Patch availableGHSA-xqhv-chqm-fhcc
  • joro VendorBishopFox Affected before 1.1.1 Fixed in 1.1.1 Patch available CNA
  • github.com/BishopFox/joro (Go) Vendor— Affected before 0.0.0-20260601151442-5c0ca35db828 Fixed in 0.0.0-20260601151442-5c0ca35db828 Patch available GHSA-xqhv-chqm-fhcc

Remediation

  • Fix · CNA joro (BishopFox) Fixed in 1.1.1
  • Fix · GHSA-xqhv-chqm-fhcc github.com/BishopFox/joro (Go) Fixed in 0.0.0-20260601151442-5c0ca35db828 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53649
  2. 2026-10-03 Alias added: GHSA-xqhv-chqm-fhcc

References

Other 3

  • TI-2025-19960 Server-Side Request Forgery (SSRF) in sliver teamserver CVSS 4.0MEDIUM 6.9
  • TI-2023-17391 Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows… CVSS 3.1HIGH 8.1
  • TI-2024-27463 BishopFox Sliver Authenticated Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2026-65413 Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC CVSS 4.0MEDIUM 6.8
  • TI-2025-19963 Sliver does not restricted traffic between Wireguard clients. CVSS 3.1MEDIUM 6.3
  • TI-2026-26522 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface CVSS 4.0MEDIUM 5.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences