CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API
Attackers can exploit DNS rebinding in Rojo's HTTP API to read source code, modify files, and execute local programs via a malicious webpage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-97875?
CVE-2026-97875 is a high-severity server-side request forgery vulnerability in rojo-rbx rojo, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.
Weakness: CWE-350
Which versions are affected by CVE-2026-97875?
1 open source package ship an affected version, including rojo.
| Package | Affected | Fixed in |
|---|---|---|
rojo crates.io | From 0.0.0-0 | 7.7.0 |
How do I fix CVE-2026-97875?
Upgrade rojo to 7.7.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-97875 being exploited?
There is no known exploitation of CVE-2026-97875 in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0279.