CyberRota Analysis
AI-GeneratedA vulnerability exists in the Network-AI package prior to version 5.15.2, where improper origin validation allows localhost Origins to be reflected in the Access-Control-Allow-Origin header. This misconfiguration can enable an attacker to exploit cross-origin resource sharing (CORS) to access unauthenticated endpoints, such as /health, when the server is bound to a non-loopback address. Organizations using affected versions should prioritize updating to mitigate potential unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin.