CVE-2026-46409
CriticalCVSS 9.6Summary
OpenYak is a local-first agent runtime, and prior to version 1.1.3 the desktop backend binds an HTTP API to 127.0.0.1:random port without Origin validation, loopback authentication, or Content-Type enforcement, with a wildcard CORS policy. Any webpage visited while OpenYak is running can issue cross-origin requests to this local server, allowing arbitrary shell command execution on the host (RCE), service shutdown, and exfiltration of chat history and PII.
Risk Assessment
A user visiting a malicious page while OpenYak is running can lead to remote code execution on the host, service disruption, and data leakage.
Recommendation
Upgrade OpenYak to version 1.1.3 or later, which includes the fix.
Original NVD description (English source)
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.