Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
#schwachstellen CVE-2026-53649: Joro-Proxy erlaubt Codeausführung über den Browser #111 #cve202653649 #joro https://cybersecurity-news.de/cve-2026-53649-joro-proxy-codeausfuehrung-browser
Post summary
A new CVE-2026-53649 has been announced—Joro-Proxy permits browser-based code execution; no PoC, exploit code, active exploitation, or patch information is provided.