CVE-2026-97875

High

Description

Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.

SeverityHigh

CVSS8.1

Exploit probability—

ProductRojo

PublishedSep 25, 2026

First seenSep 25, 2026

Weakness typeCWE-350CWE-350

How to fix

Update

rojo-rbx rojo7.7.0 or later

Patches

github.com/rojo-rbx/rojo/pull/1270

Vendor advisories

rustsec.org/advisories/RUSTSEC-2026-0279.html

Affected products

Product	Affected versions	Fixed in
rojo-rbx rojo	v < 7.7.0	7.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.