CVE-2026-108372
1 advisory.
PyPI/loopx CVE-2026-108372: high 7.1
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Action: Upgrade loopx to 0.4.5 or later.
pip install loopx==0.4.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.0.1 | 0.4.5 | - |
Fixed versions
| 0.4.5 |
Sources
- osv: GHSA-vx2m-gpq4-8j5q
- nvd: CVE-2026-108372
- https://github.com/huangruiteng/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q
- https://github.com/loopx-project/loopx/security/advisories/GHSA-vx2m-gpq4-8j5q
- https://github.com/loopx-project/loopx/pull/3137
- https://github.com/loopx-project/loopx/commit/838720fba42bd22f71b5bb763ec406f7bdf4c940
- https://github.com/huangruiteng/loopx
- https://github.com/loopx-project/loopx/releases/tag/v0.4.5
CVE-2026-108372 · published · modified · JSON