Log in / Sign up

Vulnerability details

CVE-2026-53649

BishopFox joro

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

CVSS 3.1
9.6Critical

Official description

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

CVSS scores

ScoreVersionSourceVector
9.6Critical 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
BishopFox joro < 1.1.1 CVEProject cvelistV5 (CNA)

References and advisories

2
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-02
Last updated
2026-09-04
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.33%
Probability of exploitation in 30 days
26.2%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-306
    Missing Authentication for Critical Function
  • CWE-352
    Cross-Site Request Forgery (CSRF)
  • CWE-434
    Unrestricted Upload of File with Dangerous Type
  • CWE-942
    Permissive Cross-domain Policy with Untrusted Domains