{"metadata": {"vulnerability": "CVE-2026-108372", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-08-12T16:55:09Z", "date_only": false, "value": "2026-08-12T16:55:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q", "record": "CVE-2026-108372", "field": "creation_timestamp", "uuid": "2fad9d13-507d-4b4c-b4dc-d1916395cf12", "url": "https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q"}, {"timestamp": "2026-10-09T21:36:27.042Z", "date_only": false, "value": "2026-10-09T21:36:27.042Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-108372", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T21:29:13.757Z", "date_only": false, "value": "2026-10-16T21:29:13.757Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-108372", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T21:29:13.757Z", "date_only": false, "value": "2026-10-16T21:29:13.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-108372", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:29:13.757Z", "date_only": false, "value": "2026-10-16T21:29:13.757Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-108372", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:38:18.657Z", "date_only": false, "value": "2026-10-16T21:38:18.657995Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452747449003977", "record": "CVE-2026-108372", "field": "creation_timestamp", "uuid": "20c2d6b0-814d-4420-862d-829d03d854b9", "content": "CVE-2026-108372 LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to `GET /status.json`, `GET /review-material?goal_id=...&path=...`, `GET /`, and `POST /control-plane/configure-goal/dry-run`, exposing control-plane state, goal and run information, local absolute paths, private Markdown files below registered goal roots, and dry-run configuration projections. The affected routes do not provide cross-origin writes or arbitrary-file access. This issue is fixed in version 0.4.5.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108372https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5qhttps://github.com/loopx-project/loopx/pull/3137https://github.com/loopx-project/loopx/commit/838720fba42bd22f71b5bb763ec406f7bdf4c940https://github.com/loopx-project/loopx/releases/tag/v0.4.5#huangruiteng #loopx#CVE_2026_108372#bot", "url": "https://infosec.exchange/users/cve/statuses/117452747449003977"}, {"timestamp": "2026-10-16T22:17:14Z", "date_only": false, "value": "2026-10-16T22:17:14Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VX2M-GPQ4-8J5Q", "record": "GHSA-VX2M-GPQ4-8J5Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T22:17:14.457Z", "date_only": false, "value": "2026-10-16T22:17:14.457", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108372", "record": "FKIE_CVE-2026-108372", "field": "published"}, {"timestamp": "2026-10-19T16:11:57Z", "date_only": false, "value": "2026-10-19T16:11:57Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VX2M-GPQ4-8J5Q", "record": "GHSA-VX2M-GPQ4-8J5Q", "field": "published"}, {"timestamp": "2026-10-19T16:11:57Z", "date_only": false, "value": "2026-10-19T16:11:57Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VX2M-GPQ4-8J5Q", "record": "GHSA-VX2M-GPQ4-8J5Q", "field": "modified"}, {"timestamp": "2026-10-19T21:14:14.150Z", "date_only": false, "value": "2026-10-19T21:14:14.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108372", "record": "FKIE_CVE-2026-108372", "field": "lastModified"}]}