CVE-2025-68901: Unauthenticated RCE in Dashboard API via Cross-Origin and Non-Loopback Requests

Vulnerability Overview Title: Local dashboard API accepts cross-origin and non-loopback requests, enabling unauthenticated command execution Severity: High CVE ID: CVE-2025-68901 Weaknesses: CWE-352, CWE-1365 Affected Software: career-ops web dashboard (web/, git checkout only) Affected Versions: < b3974e61 (2026-08-20) Fixed Version: b3974e61 Disclosed By: @ScottEmberson, published 2 weeks ago Scope of Impact The local web dashboard ( ) exposes routes that can spawn processes and write to user files. Prior to commit b3974e61, these routes did not validate the request origin or client certificates before responding, allowing unauthenticated access. Two Attack Paths: - F1 — Driver from another tab: A malicious page opened in the browser can make cross-origin requests to , thereby executing commands with the privileges of the user running the dashboard. - F2 — Local Network: If the dev server is bound to a non-loopback address, any host on the same LAN can directly invoke the same routes. Affected Users: Only users who run the dashboard via . The directory is excluded from the npm package ( ), and since it is not part of , users installing via are not affected. Remediation Patch: Commit b3974e61 (2026-08-20), which restricts the dashboard API to accept only same-origin requests from loopback addresses. Six Verified Attack Vectors: Cross-site blocked, LAN blocked, cross-origin blocked; same-origin in-origin/curl requests from loopback remain allowed. Temporary Mitigation (Workaround): Stop the dashboard, or explicitly bind it to , and avoid browsing untrusted pages while it is running. Remediation Action: Run in your checkout. Note: Updating via npm will not include this fix, as the npm package does not include the dashboard. POC / Exploit Code The page does not include a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-68901: Unauthenticated RCE in Dashboard API via Cross-Origin and Non-Loopback Requests

More from this source