Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Rojo server permits remote file read/write and code execution

published 5 months ago
Summary

The Rojo development tool runs a web server that does not check where requests come from. Because of this, a malicious website can trick a browser into accessing the server, read all of your project files, change them, and even launch programs on the machine without any user action. To protect yourself, keep the server on a trusted internal network only, block external access with a firewall, and upgrade to a version of Rojo that validates incoming host headers.

What to do
  • Update kampfkarren rojo to version 7.7.0.
  • Update rojo to version 7.7.0.
Affected software
Ecosystem VendorProductAffected versions
crates.io kampfkarren rojo >= 0.0.0-0, < 7.7.0
Fix: upgrade to 7.7.0
crates.io – rojo >= 0.0.0-0, < 7.7.0
Fix: upgrade to 7.7.0
Original advisory text
Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution
Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.
References
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
Timeline
Published2 Jun 2026
Updated30 Sep 2026
First seen8 Sep 2026
Sources
RUSTSEC-2026-0279 · OSV
Track software like this
Free during beta