🔴 《严重安全漏洞：CVE-2026-52842》

CVSS 评分: 严重（9.3）　　状态: Received　　发布时间: 2026-07-15

漏洞描述

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as http://attacker.com/@victim.com/ was fetched from attacker.com but treated as http://victim.com, allowing a complete Same-Origin Policy bypass. This issue is fixed in version 0.3.1.

🔍 技术细节

字段 值
CVE ID CVE-2026-52842
CVSS 评分 9.3 🔴
严重程度 严重
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE 分类 CWE-346
发布时间 2026-07-15
最后更新 2026-07-15
状态 Received
数据来源 security-advisories@github.com

🔗 参考链接