CyberRota Analysis
AI-GeneratedLightpanda versions prior to 0.2.9 are vulnerable due to improper handling of session cookies, which allows attackers to perform authenticated cross-origin requests by exploiting the fetch() and XMLHttpRequest methods. This critical vulnerability can lead to unauthorized access to sensitive data and actions on behalf of authenticated users. Organizations using Lightpanda for AI and automation should prioritize upgrading to version 0.2.9 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.