Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54565— rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

Quick assessment

Affected
edwardkim rhwp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rhwp 是一个使用 Rust 和 WebAssembly 实现的 HWP 查看器和编辑器。在 rhwp 0.7.15 之前以及 rhwp Chrome 和 Firefox 扩展程序 0.2.4 之前的版本中，浏览器扩展程序使用“所有 URL”的主机权限（all-URLs host permission）来检测访问页面中的 HWP 和 HWPX 链接，但其服务工作者（service worker）在执行特权 fetch 请求之前，未对消息发送者、URL 协议或目标地址进行验证。 受影响的文件路径包括： rhwp-c

CVSS 4.7 · Medium EPSS 0.13% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
edwardkim rhwp < 0.7.15 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54565

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
Source: CVE Program / CVE List V5
Vulnerability Description
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
edwardkim rhwp < 0.7.15 -

II. Public POCs for CVE-2026-54565

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54565

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54565 (1)

Vendor Advisories for CVE-2026-54565 (1)

IV. Related Vulnerabilities

Same weakness: CWE-200

V. Comments for CVE-2026-54565

No comments yet

Leave a comment