CVE-2026-52843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T18:41:27.724Z", "datePublished": "2026-07-15T16:16:07.762Z", "dateUpdated": "2026-07-15T17:37:26.880Z"}, "containers": {"cna": {"title": "Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc"}, {"name": "https://github.com/lightpanda-io/browser/pull/2155", "tags": ["x_refsource_MISC"], "url": "https://github.com/lightpanda-io/browser/pull/2155"}, {"name": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76", "tags": ["x_refsource_MISC"], "url": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76"}, {"name": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9"}], "affected": [{"vendor": "lightpanda-io", "product": "browser", "versions": [{"version": "< 0.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T16:16:07.762Z"}, "descriptions": [{"lang": "en", "value": "Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9."}], "source": {"advisory": "GHSA-36mm-v3c2-24cc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T17:37:05.863200Z", "id": "CVE-2026-52843", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T17:37:26.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T17:37:05.863200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T17:37:21.915Z"}}], "cna": {"title": "Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode", "source": {"advisory": "GHSA-36mm-v3c2-24cc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lightpanda-io", "product": "browser", "versions": [{"status": "affected", "version": "< 0.2.9"}]}], "references": [{"url": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc", "name": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lightpanda-io/browser/pull/2155", "name": "https://github.com/lightpanda-io/browser/pull/2155", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76", "name": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9", "name": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T16:16:07.762Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52843", "state": "PUBLISHED", "dateUpdated": "2026-07-15T17:37:26.880Z", "dateReserved": "2026-06-08T18:41:27.724Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T16:16:07.762Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "browser", "vendor": "lightpanda-io", "versions": [{"status": "affected", "version": "< 0.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9."}, {"lang": "es", "value": "Lightpanda es un navegador sin interfaz gr\u00e1fica dise\u00f1ado para IA y automatizaci\u00f3n. Antes de la 0.2.9, fetch() y XMLHttpRequest de Lightpanda adjuntaban incondicionalmente cookies de sesi\u00f3n a cada solicitud HTTP, ignorando credentials: omit, credentials: same-origin, credentials: include, y XMLHttpRequest.withCredentials, permitiendo que un origen controlado por un atacante en una sesi\u00f3n de Lightpanda emitiera solicitudes autenticadas de origen cruzado contra un origen v\u00edctima. Este problema se ha corregido en la versi\u00f3n 0.2.9."}], "id": "CVE-2026-52843", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52843", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T17:37:05.863200Z", "version": "2.0.3"}}]}, "published": "2026-07-15T17:16:50.467", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76"}, {"source": "security-advisories@github.com", "url": "https://github.com/lightpanda-io/browser/pull/2155"}, {"source": "security-advisories@github.com", "url": "https://github.com/lightpanda-io/browser/releases/tag/0.2.9"}, {"source": "security-advisories@github.com", "url": "https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "browser", "source": "cna", "vendor": "lightpanda-io"}, "product": "browser", "vendor": "lightpanda-io"}], "created": "2026-07-17T16:30:17.357025+00:00", "updated": "2026-07-31T03:30:18.071557+00:00", "vendors": ["lightpanda-io", "lightpanda-io$PRODUCT$browser"]}