https://vulnerability.circl.lu/sightings/feed 2026-09-19T23:11:29.823317+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/8dcff635-619d-4b04-9f2e-eb63429deb02/export 2026-09-19T23:11:29.843709+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "8dcff635-619d-4b04-9f2e-eb63429deb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-77339", "type": "seen", "source": "https://gist.github.com/alon710/66235754231ab35fdbefaafc90c146d5", "content": "# CVE-2026-77339: CVE-2026-77339: Unauthenticated Remote Command Execution in Process Compose via DNS Rebinding\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77339\n\n## Summary\nCVE-2026-77339 is a critical security vulnerability in Process Compose before version 1.120.0. The Model Context Protocol (MCP) Server-Sent Events (SSE) listener transport subsystem fails to validate the HTTP Host and Origin headers, and does not enforce authentication. This omissions expose local loopback listeners to DNS rebinding attacks orchestrated by malicious remote websites visited by developers, enabling unauthorized process control and arbitrary command execution.\n\n## TL;DR\nProcess Compose before version 1.120.0 lacks Host header, Origin header, and authentication validation on its secondary MCP SSE listener. Remote malicious websites can leverage DNS rebinding to execute arbitrary commands locally on a developer's workstation if control tools are enabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306, CWE-346\n- **Attack Vector**: Network (Requires User Interaction & DNS Rebinding)\n- **CVSS v4.0**: 5.1 (Medium)\n- **EPSS Score**: Not yet assigned\n- **Impact**: Information Disclosure, Denial of Service, Remote Code Execution\n- **Exploit Status**: PoC / Theoretical\n- **KEV Status**: Not in KEV Catalog\n\n## Affected Systems\n\n- Process Compose prior to v1.120.0\n- **process-compose**: < 1.120.0 (Fixed in: `1.120.0`)\n\n## Mitigation\n\n- Upgrade Process Compose to version v1.120.0 or later.\n- Configure global authentication tokens using the PC_API_TOKEN environment variable.\n- Restrict binding configurations to local loopback interfaces (127.0.0.1).\n- Disable the expose_control_tools parameter in configurations when not in use.\n\n**Remediation Steps:**\n1. Verify the version of Process Compose currently deployed in the local development environment.\n2. Obtain and install binary version 1.120.0 or newer from the official release page.\n3. Set up the PC_API_TOKEN system environment variable with a strong, randomly generated string.\n4. Modify the process-compose.yaml file to ensure trusted_hosts is not configured to allow wildcard values.\n\n## References\n\n- [GitHub Security Advisory GHSA-5gm3-9crp-6g3v](https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v)\n- [Process Compose v1.120.0 Release Notes](https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0)\n- [NVD CVE-2026-77339 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-77339)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77339) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T09:31:52.677867Z"} 2026-09-19T09:31:52.677867+00:00 https://vulnerability.circl.lu/sighting/a0c99ae1-ffe2-4bd1-83ac-142137ead766/export 2026-09-19T23:11:29.845671+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "a0c99ae1-ffe2-4bd1-83ac-142137ead766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-77339", "type": "published-proof-of-concept", "source": "https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v", "content": "", "creation_timestamp": "2026-09-18T18:35:05.941054Z"} 2026-09-18T18:35:05.941054+00:00