rojo vulnerabilities

1 known vulnerability in rojo from Rojo-rbx. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  rojo: Reliance on Reverse DNS Resolution for a Security-Critical Action

  CVE-2026-97875Sep 25, 2026Rojo-rbx

  Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open()