CVE-2026-19352 in lossless-cut
Summary
by MITRE • 08/09/2026
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The vulnerability identified in lossless-cut version 3.69.0 represents a server-side request forgery issue within the built-in HTTP API service component, specifically affecting the file src/main/httpServer.ts. This security flaw enables attackers to manipulate the application's network requests, potentially allowing unauthorized access to internal systems or services that would normally be protected by network segmentation. The vulnerability requires local network access to exploit, indicating that it cannot be leveraged from external networks but poses a significant risk within compromised local environments where attackers have already gained sufficient access to interact with the application's HTTP interface.
The technical implementation of this vulnerability stems from insufficient validation of user-supplied input within the HTTP server functionality, allowing malicious actors to craft requests that bypass normal security controls. The attack complexity is classified as high due to the requirement for local network access and the need to understand the specific manipulation patterns necessary to trigger the vulnerability. This complexity level suggests that exploitation requires specialized knowledge of both the application's internal architecture and network protocols, making it less likely to be exploited by casual attackers but still concerning given its potential impact on systems where local network access is already compromised.
From a cybersecurity perspective, this vulnerability aligns with CWE-918, which covers server-side request forgery vulnerabilities that allow attackers to manipulate requests made by servers to other systems. The ATT&CK framework categorizes this type of vulnerability under T1190 - Proxy Execution and T1071.004 - Application Layer Protocol: DNS, as it involves manipulating application-level network communications to achieve unauthorized access. The exploitation difficulty factor indicates that while the vulnerability exists, attackers must overcome significant technical barriers to successfully leverage it, though the public disclosure of exploit methods increases the risk level.
The security patch identified by the hash 260802348955231442c4bae6c2d9d8ede947af0a addresses the core issue by implementing proper input validation and request sanitization within the HTTP server component. The project maintainer's assessment that this vulnerability is not critical due to its dependence on an experimental CLI flag suggests that the functionality is not enabled by default, reducing the attack surface for typical users. However, this characterization may be misleading since even experimental features can be activated by users who understand the implications, and the NTLM behavior referenced by the maintainer represents a separate but related security concern that could compound the overall risk profile.
Organizations utilizing lossless-cut should prioritize applying the available patch to mitigate this vulnerability, particularly in environments where local network access is not strictly controlled or where the experimental HTTP API service has been enabled. The CVSS vector reflecting high pre-requisites indicates that while the vulnerability requires specific conditions to exploit, these conditions may be met in compromised environments. Security teams should monitor for any additional information regarding exploitation attempts and consider implementing network segmentation controls to limit potential impact if the vulnerability is successfully exploited. The combination of public disclosure and the relatively high complexity requirements means that while this may not be a top-priority vulnerability, it still represents an important security consideration that should be addressed as part of comprehensive vulnerability management programs.