Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-88061— career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

Quick assessment

Affected
santifer career-ops
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

career-ops 是一款开源的 AI 辅助求职与应用管理工具。在 0.8.0 版本之前，其本地 Web 仪表盘（位于 目录）暴露了可执行命令的 路由以及用户文件写入接口，但并未验证请求来源，也未将客户端限制在回环地址（loopback）。这意味着，当仪表盘正在运行时，恶意网页可以通过跨源 localhost 请求发起攻击；而如果仪表盘绑定到了非回环地址，则可能接收到来自本地网络的直接请求。这两种路径都允许未认证的用户以仪表盘进程的运行用户身份执行命令。不过，通过 npm 安装的场景不受影响，因为 目录已被排除在

CVSS 5.8 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
santifer career-ops < 0.8.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88061

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
Source: CVE Program / CVE List V5
Vulnerability Description
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
santifer career-ops < 0.8.0 -

II. Public POCs for CVE-2026-88061

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88061

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-88061 (1)

Vendor Advisories for CVE-2026-88061 (1)

Vendor Pages for CVE-2026-88061 (1)

IV. Related Vulnerabilities

Same weakness: CWE-352

V. Comments for CVE-2026-88061

No comments yet

Leave a comment