Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-53649: Joro: Unauthenticated Plugin Upload Allows Remote Code Execution

CVE-2026-53649 · published 1 day ago

Summary

Joro's default proxy mode allows attackers to upload malicious plugins and execute code on the system without a password. This can happen when a user visits a website with malicious JavaScript. To fix this, update Joro to version 1.2.0 or later and change the proxy mode to a more secure setting.

What to do

Update github.com bishopfox to version 0.0.0-20260601151442-5c0ca35db828.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	bishopfox	joro	< 1.1.1
go	github.com	bishopfox	< 0.0.0-20260601151442-5c0ca35db828 Fix: upgrade to 0.0.0-20260601151442-5c0ca35db828

Original advisory text

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

References

Severity

9.6 Critical

CVSS 3.1: 9.6 (GHSA)

Type

CWE-306Missing Authentication for Critical Function

CWE-352Cross-Site Request Forgery (CSRF)

CWE-434Unrestricted File Upload

CWE-942Permissive Cross-domain Security Policy with Untrusted Domains

Timeline

Published2 Sep 2026

Updated2 Sep 2026

First seen8 Jul 2026

Sources

GHSA-xqhv-chqm-fhcc · GHSA

CVE-2026-53649 · NVD

CVE-2026-53649 · MITRE

Monitor software like this

Free during beta