Lightpanda-io vulnerabilities
We track 2 vulnerabilities in Lightpanda-io products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2026.
2vulnerabilities
2critical
0high
0exploited
9.3average CVSS score
Latest Lightpanda-io vulnerabilities
- 9.3 Critical severity
browser: Origin Validation Error
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, a
- 9.3 Critical severity
browser: Origin Validation Error
Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` wa