CVE-2026-102344 - Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
CVE ID :CVE-2026-102344 Published : Nov. 6, 2026, 9:17 p.m. | 1 hour, 55 minutes ago Description :Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact,...