CVE-2026-53656: FiftyOne Platform XSS Vulnerability

CVE-2026-53656 Overview

CVE-2026-53656 is an origin validation flaw [CWE-346] in FiftyOne, the open-source platform for refining datasets and visual AI models. Versions prior to 1.17.0 unconditionally return an Access-Control-Allow-Origin: * header from the App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py. Because the embedded server is local and unauthenticated, any website a developer visits in the same browser can issue cross-origin requests and read responses. The /media endpoint accepts a filesystem path, letting a drive-by page read arbitrary files accessible to the server process. Version 1.17.0 defaults to same-origin and introduces the allowed_origins configuration.

Critical Impact
A malicious webpage visited by a FiftyOne user can silently read datasets and local files from the loopback server and exfiltrate them without further user interaction.

Affected Products

Voxel51 FiftyOne versions prior to 1.17.0
FiftyOne App/API server (fiftyone/server/app.py)
FiftyOne /media route (fiftyone/server/routes/media.py)

Discovery Timeline

2026-08-21 - CVE-2026-53656 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-53656

Vulnerability Analysis

FiftyOne runs an embedded HTTP server on the developer workstation to power its App and API. Prior to 1.17.0, that server responded to every request with Access-Control-Allow-Origin: *. The wildcard tells the browser to allow any cross-origin caller to read the response body.

Because the server binds to a local, unauthenticated interface, it relied entirely on the browser's Same-Origin Policy for isolation. The permissive CORS header removed that boundary. Any site the user browsed while FiftyOne was running could issue fetch() calls to http://localhost:<port> and read the returned JSON, images, or file contents.

The /media route amplifies the impact. It accepts a filesystem path parameter and streams the referenced file back to the caller. Combined with the wildcard CORS policy, a single scripted request from an attacker-controlled page can read any file the FiftyOne process can access.

Root Cause

The server hard-coded a wildcard CORS response without consulting an allow-list. Origin validation was absent, which maps directly to CWE-346 (Origin Validation Error). The design assumed a same-origin browser context but did not enforce it.

Attack Vector

Exploitation requires the victim to run FiftyOne locally and visit a malicious page in the same browser session. The attacker page issues fetch('http://localhost:5151/media?path=/home/user/.ssh/id_rsa') and reads the response. No credentials or additional clicks are required. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:C/C:H reflects the local attack surface, required user navigation, scope change into the local server, and high confidentiality impact.

text

// Patched documentation added in commit 6c4fa1b
// docs/source/installation/environments.rst

+.. _cross-origin-app-access:
+
+Cross-origin App access
+~~~~~~~~~~~~~~~~~~~~~~~
+
+By default the App server only accepts same-origin requests, which covers
+local desktop usage and the supported notebook integrations, since each of
+those serves the App through a same-origin proxy or iframe. Most users do
+not need to change this.
+
+If a trusted origin must access the App server, you can add it to the
+`allowed_origins` configuration:
+
+.. code-block:: shell
+
+    export FIFTYONE_ALLOWED_ORIGINS='https://trusted.example.com'
+
+.. warning::
+
+    Do not set `allowed_origins` to `*`. The wildcard allows any website
+    your browser visits to make cross-origin requests to your running App
+    server and read the responses, which can expose your datasets and local
+    files to a malicious page. Always list specific, trusted origins instead.

Source: GitHub Commit 6c4fa1b

Detection Methods for CVE-2026-53656

Indicators of Compromise

Outbound HTTP responses from the local FiftyOne server carrying Access-Control-Allow-Origin: * on the /media or App routes.
Browser network logs showing fetch() or XMLHttpRequest calls to http://localhost:5151 or the configured FiftyOne port from unrelated third-party origins.
Access log entries for /media?path=... containing filesystem paths outside the active FiftyOne dataset directory.

Detection Strategies

Inspect running FiftyOne instances and confirm the installed version is 1.17.0 or later using pip show fiftyone.
Review HTTP response headers from the FiftyOne App server to verify the wildcard CORS header is no longer returned by default.
Correlate browser telemetry with local process listeners to identify cross-origin requests targeting developer loopback ports.

Monitoring Recommendations

Log all requests to the FiftyOne /media endpoint and alert on paths that resolve outside expected dataset roots.
Monitor for the FIFTYONE_ALLOWED_ORIGINS environment variable being set to *, which restores the vulnerable behavior.
Track FiftyOne process file reads on workstations to detect access to sensitive paths such as SSH keys, cloud credential files, or user home directories.

How to Mitigate CVE-2026-53656

Immediate Actions Required

Upgrade FiftyOne to version 1.17.0 or later on all developer workstations and shared analysis hosts.
Audit any deployments that previously customized CORS behavior and confirm allowed_origins is unset or contains only explicit trusted origins.
Restrict browser sessions used with FiftyOne from visiting untrusted sites while the App server is running.

Patch Information

The fix ships in FiftyOne 1.17.0. The server now defaults to a same-origin policy and reads the allowed_origins configuration (or FIFTYONE_ALLOWED_ORIGINS environment variable) to permit specific cross-origin callers. See the GitHub Security Advisory GHSA-q78p-hj9h-5466 and the FiftyOne 1.17.0 Release. Patch commits: 6c4fa1b and 7c5b92e.

Workarounds

Bind the FiftyOne App server strictly to 127.0.0.1 and avoid exposing it on 0.0.0.0.
Use a dedicated browser profile with no third-party browsing when working with FiftyOne datasets.
If upgrading is not immediately possible, run FiftyOne inside an isolated container or VM so /media cannot reach sensitive host files.

bash

# Configuration example - FiftyOne 1.17.0+ same-origin default
# Only set this if a trusted origin must reach the App server
export FIFTYONE_ALLOWED_ORIGINS='https://trusted.example.com'

# Do NOT set the wildcard - this restores the vulnerable behavior
# export FIFTYONE_ALLOWED_ORIGINS='*'