Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, control the Archon UI features, and steal all Archon information available on the UI including API keys.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
My POC for CVE-2025-69443 -> executing commands and exfiltrating data on Archon OS using CORS bypass https://www.youtube.com/watch?v=t5GBb6-AScE
Post summary
The user shares a PoC video showing how CVE-2025-69443 allows command execution and data exfiltration on Archon OS via a CORS bypass.
🚨 NEW Critical MCP Flaws 🚨 We discovered 3 new vulnerabilities in MCPs CVE-2025-65719 - ArchonOS CORS bypass exploit CVE-2025-69443 - kubectl-mcp-server Unauthenticated RCE Won't Fix - MarkItDown MCP - LPE via POST request The Archon OS CORS bypass allows any website to communicate with Archon and cross web to local boundaries to extract sensitive information and even control the Archon OS itself! (Check the POC it's pretty amazing - https://www.youtube.com/watch?v=t5GBb6-AScE) The kubectl-mcp-server vulnerability allows an attacker to execute commands on the kubectl-mcp-server by simply opening a malicious website. Click a link? -> command exec. BOOM. We published a LPE in MarkItDown MCP which won't be fixed, enabling a local attacker to reach files via POST requests when MarkItDown MCP is running on the machine. If you want to read more -> Main article: https://www.ox.security/blog/new-mcp-security-flaws-kubectl-mcp-server-archon-os-and-markitdown-vulnerabilities/ CVE-2025-69443 - Archon OS: https://www.ox.security/blog/cve-2025-69443-archon-os-vulnerable-to-unauthenticated-web-to-client-attack/ CVE-2025-65719 - kubectl-mcp-server: https://www.ox.security/blog/cve-2025-65719-critical-rce-in-kubectl-mcp-server/ MarkItDown MCP: https://www.ox.security/blog/markitdown-mcp-exposes-developer-machines-to-file-theft/
Post summary
The post announces three critical MCP vulnerabilities with brief technical details and provides PoC links and blog posts, but no active exploitation evidence or patch information.
🚨 High - Archon OS Unauthenticated Web-to-Client Attack (CVE-2025-69443) A critical vulnerability in Archon OS allows unauthenticated attackers to execute a "web-to-client" attack by exploiting a flaw in the system's local API handling. By enticing a user to visit a malicious website, an attacker can trigger unauthorized local commands on the victim's machine, leading to full Remote Code Execution (RCE) and system compromise. 👉 Affected: Archon OS all versions as of May 12th
Post summary
Archon OS suffers a critical unauthenticated RCE vulnerability (CVE‑2025‑69443) that can be triggered via a malicious website; no PoC, exploit, or patch details are provided.