CVE-2026-108372: CWE-346: Origin Validation Error in huangruiteng loopx

LoopX versions 0.0.1 through 0.4.4 have an origin validation error (CWE-346) in the status server component. Specifically, the `loopx serve-status` functionality in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` methods to send an Access-Control-Allow-Origin: * header on unauthenticated responses on predictable loopback ports. This misconfiguration enables a remote attacker to induce an operator visiting attacker-controlled web content to issue cross-origin GET and POST requests to sensitive endpoints such as `/status.json`, `/review-material`, `/`, and `/control-plane/configure-goal/dry-run`. The attacker can thereby access control-plane state, goal and run information, local absolute paths, private Markdown files under registered goal roots, and dry-run configuration projections. However, the affected endpoints do not permit cross-origin writes or arbitrary file access. The vulnerability is addressed in loopx version 0.4.5.

An attacker can exploit this vulnerability to cause an operator's browser to send cross-origin requests to the loopx control plane on localhost, exposing sensitive information including control-plane state, goal and run details, local absolute paths, private Markdown files, and configuration projections. This information disclosure could aid further attacks or leak sensitive operational data. There is no indication of cross-origin write or arbitrary file access capabilities, limiting the impact to information disclosure only.

This vulnerability is fixed in loopx version 0.4.5. Users should upgrade to version 0.4.5 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.