Submit #1021288: https://github.com/massCodeIO/massCode massCode 5.10 Local Sensitive Logic Exposure leading to airbitary notes/code r

The local HTTP service exposed by massCode can be accessed by callers outside the intended application boundary.

During testing, the massCode API was observed to listen on all network interfaces, rather than being restricted exclusively to the loopback interface. At the same time, the API enables permissive cross-origin access:

// src/main/api/index.ts
.use(cors({ origin: '*' }))
Sensitive Notes and Snippets endpoints do not require authentication or another trusted-client credential.

Examples include:

GET /notes
GET /notes/:id
POST /notes
PATCH /notes/:id/content
DELETE /notes/:id

GET /snippets
GET /snippets/:id

GET /note-folders
POST /note-tags
Consequently, an attacker-controlled web page may be able to communicate directly with the massCode API running on the victim's machine and retrieve sensitive local information, including:

the user's Notes list;
complete Note contents;
code Snippet metadata;
complete code Snippet contents.
Where state-changing endpoints are reachable, the exposed API may additionally allow unauthorized creation, modification, or deletion of locally stored data.

• Source: ⚠️ https://github.com/massCodeIO/massCode/issues/966
• User: Anonymous User
• Submission: 10/09/2026 08:06 (13 days ago)
• Moderation: 10/21/2026 20:13 (13 days later)
• Status: Accepted
• VulDB entry: 424941 [massCodeIO massCode 5.10 Local HTTP Service src/main/api/index.ts information disclosure]
• Points: 20