{"uuid": "80954a4d-e05e-4199-bae1-f26de39945fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84452", "type": "seen", "source": "https://gist.github.com/alon710/c5bce716a2c740f354075cb003953b3f", "content": "# CVE-2026-84452: CVE-2026-84452: Localhost Remote Code Execution via CORS Misconfiguration in Windows ML CLI\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84452\n\n## Summary\nA critical vulnerability (CVE-2026-84452) in the Windows ML CLI (winml-cli) HTTP server component allows unauthenticated remote code execution via permissive CORS and lack of request validation.\n\n## TL;DR\nUnauthenticated remote code execution in winml-cli before 0.4.0 via CORS wildcard and lack of loopback verification.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-942, CWE-306\n- **Attack Vector**: Network (via Browser Cross-Origin Request)\n- **CVSS v4.0 Score**: 8.6\n- **EPSS Score**: 0.00945 (58.83rd percentile)\n- **Impact**: Remote Code Execution\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Windows ML CLI (winml-cli)\n- **winml-cli**: < 0.4.0 (Fixed in: `0.4.0`)\n\n## Mitigation\n\n- Upgrade to winml-cli 0.4.0 or higher\n- Implement browser Private Network Access controls\n- Shut down local dev servers when not in use\n\n**Remediation Steps:**\n1. Run pip install --upgrade winml-cli>=0.4.0\n2. Configure workstation firewall to block incoming external connections to localhost ports\n3. Enable PNA on enterprise browsers\n\n## References\n\n- [GitHub Security Advisory GHSA-96p9-rh4f-92cf](https://github.com/microsoft/winml-cli/security/advisories/GHSA-96p9-rh4f-92cf)\n- [Microsoft Fix Commit f4073e0](https://github.com/microsoft/winml-cli/commit/f4073e0ef4700a25b623487e7e45c421ca0b9993)\n- [GitHub Pull Request #1321](https://github.com/microsoft/winml-cli/pull/1321)\n- [National Vulnerability Database Record](https://nvd.nist.gov/vuln/detail/CVE-2026-84452)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-84452)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84452) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-09T09:33:16.652278Z"}