CVE-2026-53649: Joro Web Framework RCE Vulnerability

CVE-2026-53649 Overview

CVE-2026-53649 affects Joro, a web exploitation framework developed by Bishop Fox. Versions prior to 1.1.1 expose an unauthenticated local API on 127.0.0.1:9090 with a wildcard Cross-Origin Resource Sharing (CORS) policy. Any website an operator visits can upload a native plugin and trigger a restart through the operator's browser. Plugins execute on load, yielding remote code execution as the operator's user from a single page visit. The maintainer released version 1.1.1 to address the flaw. The weakness is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
A single visit to an attacker-controlled webpage results in arbitrary code execution as the Joro operator's user account.

Affected Products

Bishop Fox Joro versions prior to 1.1.1
Joro default proxy mode configurations
Operator systems running Joro alongside a standard web browser

Discovery Timeline

2026-09-02 - CVE-2026-53649 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-53649

Vulnerability Analysis

Joro's default proxy mode binds a local management API to 127.0.0.1:9090. The API performs no authentication and responds with a wildcard Access-Control-Allow-Origin: * header. Cross-origin JavaScript loaded in the operator's browser can therefore reach every endpoint exposed by this service. The privileged surface includes plugin upload and service restart operations.

The plugin upload endpoint accepts multipart/form-data requests. This content type is CORS-safelisted, so browsers issue the request directly without a preflight OPTIONS check. The operator does not need to be authenticated to the target Joro instance because no authentication exists at all.

Root Cause

The root cause is missing authentication combined with an overly permissive CORS policy on a locally bound management interface. Binding to 127.0.0.1 was treated as a security boundary, but browsers running on the same host can reach loopback services. The wildcard CORS header eliminates the same-origin restriction that would otherwise block cross-origin reads and writes.

Attack Vector

An attacker hosts a malicious webpage containing JavaScript that submits a multipart/form-data POST to http://127.0.0.1:9090 with a crafted native plugin payload. When a Joro operator visits the page, their browser issues the request without a preflight. The API accepts the plugin upload and, on triggered restart, loads the plugin. Plugin code executes with the operator's user privileges, delivering unauthenticated remote code execution driven entirely by a drive-by page visit.

Detailed technical references are available in the GitHub Security Advisory GHSA-xqhv-chqm-fhcc and the Joro 1.1.1 release notes.

Detection Methods for CVE-2026-53649

Indicators of Compromise

Unexpected plugin files written to the Joro plugin directory on operator workstations
Outbound HTTP requests from browser processes to 127.0.0.1:9090 originating from non-Joro web origins
Joro service restarts that correlate with recent web browsing activity
New child processes spawned by the Joro binary after a browser session

Detection Strategies

Monitor local loopback traffic to port 9090 and correlate the initiating process with the browser tab origin
Alert on filesystem writes to Joro's plugin directory that do not originate from a controlled deployment workflow
Track process ancestry where Joro or its plugin loader spawns interactive shells, scripting hosts, or network utilities

Monitoring Recommendations

Enable endpoint telemetry on operator workstations that use Joro and forward process, file, and network events to a central data store
Baseline expected Joro plugin inventory and alert on additions or hash changes
Review browser history and DNS logs for pages visited immediately before anomalous Joro activity

How to Mitigate CVE-2026-53649

Immediate Actions Required

Upgrade Joro to version 1.1.1 or later on every operator workstation
Terminate any running Joro proxy instances that bind to 127.0.0.1:9090 until the upgrade is complete
Audit the plugin directory for unauthorized native plugins and remove any that were not deployed intentionally
Rotate credentials and tokens that were reachable from operator workstations during the exposure window

Patch Information

Bishop Fox published the fix in Joro 1.1.1. Download the patched release from the Joro 1.1.1 GitHub release page. Verify the installed version with joro --version after upgrading.

Workarounds

Do not browse untrusted websites while Joro's default proxy mode is running on a vulnerable version
Restrict operator workstations with host-based firewall rules that block browser processes from connecting to loopback port 9090
Run Joro inside a dedicated virtual machine or container isolated from the browsing environment

bash

# Upgrade Joro to the patched release
git fetch --tags
git checkout 1.1.1
go install ./...
joro --version