TI-2026-64285 Aliases CVE-2026-97875

DNS rebinding vulnerability in rojo serve HTTP API

LOW 37CWE-350Published 2026-09-25 · Updated 2026-09-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0026 17th percentileScored 2026-11-07

Fix Fixed rojo (rojo-rbx): 7.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rojo-rbx	rojo	before 7.7.0	7.7.0	Patch available	CNA

rojo Vendorrojo-rbx Affected before 7.7.0 Fixed in 7.7.0 Patch available CNA

Remediation

Fix · CNA rojo (rojo-rbx) Fixed in 7.7.0

Timeline

2026-10-02 Threatist record created from CVE-2026-97875

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences