CVE-2026-19352: LosslessCut SSRF Vulnerability

CVE-2026-19352 Overview

CVE-2026-19352 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the mifi lossless-cut video editor, affecting versions up to and including 3.69.0. The flaw resides in the built-in HTTP API service implemented in src/main/httpServer.ts. An attacker on the local network can craft requests that cause the application to issue unintended outbound requests. The project maintainer notes that the affected functionality is gated behind an experimental CLI flag, which limits real-world exposure. The issue has been patched in commit 260802348955231442c4bae6c2d9d8ede947af0a.

Critical Impact
Exploitation requires adjacent network access, high attack complexity, and depends on an experimental CLI flag being enabled, resulting in low confidentiality impact.

Affected Products

mifi lossless-cut versions up to and including 3.69.0
Component: Built-in HTTP API Service (src/main/httpServer.ts)
Affected functionality: experimental CLI flag exposing the HTTP API

Discovery Timeline

2026-08-09 - CVE-2026-19352 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19352

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery [CWE-918]. The lossless-cut desktop application exposes an HTTP API when launched with an experimental CLI flag. The API in src/main/httpServer.ts did not adequately validate the origin of incoming requests. An attacker able to reach the listener on the local network, or trick a browser on the local machine into issuing crafted requests, could cause the application to act on requests it should not trust.

The maintainer states the NTLM behavior at the root of the SSRF pattern is not strictly a LosslessCut bug, and the affected HTTP surface is not enabled by default. Exploitation is described as difficult and requires adjacent network positioning. A public disclosure exists, but no in-the-wild exploitation has been reported.

Root Cause

The HTTP server accepted requests without verifying that they originated from a trusted local client. Missing checks on the Host and Origin headers allowed two attack primitives: DNS rebinding, where an attacker-controlled domain resolves to 127.0.0.1 and becomes same-origin with the local API, and cross-site request forgery from web pages the user visits. Because browsers always send Origin on cross-origin requests and POSTs while non-browser local clients do not, the absence of these header checks removed the primary boundary between local tooling and remote attackers.

Attack Vector

An adjacent-network attacker, or a remote attacker who can lure the user to a malicious web page while the experimental HTTP API is active, sends crafted HTTP requests to the local lossless-cut API. The application then issues outbound requests on the attacker's behalf, enabling SSRF-style interactions with internal services.

typescript

// Security patch: src/main/httpServerUtil.ts
// The HTTP API has no authentication, so we need to make sure that requests actually come from a
// program running on this machine, and not from a web page that the user happens to be visiting.
// - Checking `Host` prevents DNS rebinding, where an attacker controlled domain name is made to
//   resolve to 127.0.0.1 so that their page becomes same-origin with us.
// - Checking `Origin` prevents CSRF. Browsers always send `Origin` on cross origin requests (and on
//   all POSTs), while non-browser clients like curl never send it.
// eslint-disable-next-line import/prefer-default-export
export function isRequestAllowed({ host, origin, port }: {
  host: string | undefined,
  origin: string | undefined,
  port: number,
}) {
  if (origin != null) return false;
  if (host == null) return false;
  const allowedHosts = ['127.0.0.1', 'localhost', '[::1]'];
  const hostLower = host.toLowerCase();
  // a browser omits the port from `Host` when it's the default port for the scheme
  return allowedHosts.some((allowedHost) => hostLower === `${allowedHost}:${port}` || (port === 80 && hostLower === allowedHost));
}

Source: GitHub Commit 260802

Detection Methods for CVE-2026-19352

Indicators of Compromise

Outbound HTTP requests from the lossless-cut process to unexpected internal IP ranges or external domains not associated with normal video import workflows.
Local HTTP listener bound by lossless-cut when the experimental CLI flag is set, receiving requests with missing or unusual Origin headers.
DNS resolutions from attacker-controlled hostnames to loopback addresses (127.0.0.1, [::1]) on hosts running lossless-cut.

Detection Strategies

Monitor process-level network telemetry for lossless-cut making outbound connections beyond expected media source hosts.
Alert on desktop application processes listening on TCP ports that receive requests with Host headers pointing to non-loopback names.
Correlate browser navigation events with local listener traffic to detect DNS rebinding patterns targeting developer or media tooling.

Monitoring Recommendations

Inventory endpoints running lossless-cut and identify any launched with the experimental HTTP API flag enabled.
Log and retain HTTP request metadata (Host, Origin, source IP) for any local API surfaces exposed by desktop applications.
Track versions of lossless-cut deployed across the environment to identify hosts still on 3.69.0 or earlier.

How to Mitigate CVE-2026-19352

Immediate Actions Required

Upgrade lossless-cut to a build that includes commit 260802348955231442c4bae6c2d9d8ede947af0a or later.
Disable the experimental HTTP API CLI flag on all installations until the patched version is deployed.
Restrict local network access to workstations running the vulnerable version, particularly on shared or untrusted segments.

Patch Information

The fix introduces isRequestAllowed in src/main/httpServerUtil.ts, which validates the Host header against a loopback allowlist (127.0.0.1, localhost, [::1]) and rejects any request that includes an Origin header. This blocks both DNS rebinding and browser-originated CSRF against the local API. Details are available in the GitHub commit 260802 and the VulDB entry for CVE-2026-19352.

Workarounds

Do not launch lossless-cut with the experimental HTTP API CLI flag enabled.
Bind the application host to trusted networks only and block inbound access to lossless-cut listener ports via host firewall rules.
Avoid browsing untrusted web content on workstations where the experimental HTTP API is active.

bash

# Host firewall example: block inbound connections to the lossless-cut HTTP API port on Linux
# Replace <PORT> with the port used by the experimental HTTP API
sudo iptables -A INPUT -p tcp --dport <PORT> ! -s 127.0.0.1 -j DROP
sudo ip6tables -A INPUT -p tcp --dport <PORT> ! -s ::1 -j DROP