CVE-2026-88061
Summary
by MITRE • 09/10/2026
career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The career-ops application serves as an open-source tool designed to assist users with job searching and application management through an AI-assisted interface. A significant security vulnerability was identified in versions prior to 0.8.0, specifically affecting the local web dashboard component located within the web/ directory. This flaw stems from a failure to implement proper access controls on critical API endpoints that handle command spawning and user file writing operations. The affected routes were exposed without validating the origin of incoming requests or restricting client connections exclusively to loopback addresses such as 127.0.0.1. Consequently, these sensitive functionalities remained accessible to any entity capable reaching the service port, creating a severe security gap in the application's local deployment model.
The operational impact of this vulnerability manifests through two distinct attack vectors depending on how the dashboard is bound and accessed. First, when the dashboard is running locally with standard loopback binding, it remains vulnerable to Cross-Site Request Forgery (CSRF) style attacks originating from malicious web pages hosted in other browser tabs or windows. Because the application does not validate the Origin header or implement strict Same-Origin Policy checks for these specific API routes, a compromised or malicious webpage can programmatically send requests to localhost endpoints while the career-ops dashboard is active in another tab. This allows an attacker who has gained execution context within the user's browser environment to trigger unauthenticated command execution as the currently logged-in dashboard user. Second, if the developer binds the dashboard interface beyond loopback addresses to allow remote access or testing on a local network, the vulnerability expands significantly. In this configuration, any device connected to the same network can send direct requests to the exposed API endpoints without authentication, effectively turning the local development tool into an internet-facing service with no security controls.
This issue is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it allows for arbitrary command execution on the host system. The severity of this vulnerability lies in its potential to lead to full local system compromise if an attacker can trick a user into visiting a malicious site or exploit network accessibility misconfigurations. It is important to note that npm installations were not affected by this specific flaw because the web/ directory containing the vulnerable dashboard code was explicitly excluded from the published package, limiting exposure primarily to developers and users running the tool directly from source code during development or testing phases.
To mitigate these risks, it is imperative for all users of career-ops prior version 0.8.0 to upgrade immediately to version 0.8.0 where this issue has been resolved. For organizations still maintaining older versions in isolated environments, strict network segmentation should be enforced to ensure the dashboard interface is never bound to non-loopback interfaces unless absolutely necessary and properly secured with additional authentication layers such as reverse proxy configurations or token-based access controls. Developers integrating similar local web services must adhere to security best practices by always validating request origins using CORS policies where appropriate and restricting API endpoints to localhost bindings during development, while implementing robust input validation and authorization checks for any functionality that interacts with the operating system's command interpreter or file system.