CVE-2026-53649 Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
Unauthenticated cross-origin plugin upload in Joro allows remote code execution via a single page visit due to missing authentication and wildcard CORS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53649?
CVE-2026-53649 is a critical vulnerability in BishopFox joro, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.
Which versions are affected by CVE-2026-53649?
3 open source packages ship an affected version, including github.com/BishopFox/joro.
| Package | Affected | Fixed in |
|---|---|---|
github.com/BishopFox/joro Go | All versions | 0.0.0-20260601151442-5c0ca35db828 |
github.com/BishopFox/joro Go | All versions | 0.0.0-20260601151442-5c0ca35db828 |
github.com/BishopFox/joro Go | All versions | 0.0.0-20260601151442-5c0ca35db828 |
How do I fix CVE-2026-53649?
Upgrade github.com/BishopFox/joro to 0.0.0-20260601151442-5c0ca35db828 or later.
Is CVE-2026-53649 being exploited?
There is no known exploitation of CVE-2026-53649 in the wild and no public exploit code.
Sources
Also known as GHSA-xqhv-chqm-fhcc, GO-2026-5947.