CVE-2026-53649

Joro versions prior to 1.1.1 expose an unauthenticated local API on 127.0.0.1:9090 when running in default proxy mode, and that API applies a wildcard CORS policy. Because the privileged endpoints accept CORS-safelisted multipart/form-data uploads, JavaScript on any website the operator visits can silently upload a plugin or trigger a restart through the operator's own browser, with no preflight request or credentials required (a cross-site request forgery against a localhost service). Since uploaded plugins execute on load, an attacker gains unauthenticated remote code execution on the operator's machine, running with the operator's user privileges, from a single malicious page visit. Affected users are operators of the Joro web exploitation framework — typically security researchers and penetration testers — running any version before 1.1.1 in default proxy mode. Exploitation is not currently known to occur in the wild: there is no public proof of concept, the EPSS score is low (0.2% over 30 days), and the flaw is not in CISA's KEV catalog.

What to do: Upgrade Joro to version 1.1.1 or later, which closes the unauthenticated local API exposure. Until upgraded, avoid browsing untrusted websites from any host running Joro's proxy, or restrict the local API (e.g., disable it or change the default port/bind) while working. Also check the framework's plugin directory for unexpected uploads and review recent unexpected restarts as signs of prior exploitation.