CVE-2026-97875 describes a security vulnerability in the rojo-rbx project's 'rojo serve' HTTP API. The API does not validate Host or Origin headers, making it susceptible to DNS rebinding attacks. Exploitation allows an attacker controlling a malicious webpage to read all project source code, write malicious code to local files, and launch local programs through the opener::open() function without further user consent beyond visiting the malicious page. The vulnerability affects rojo versions from 0 up to but not including 7.7.0. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts but no availability impact.

Successful exploitation can lead to full disclosure of project source code, unauthorized modification of files on the victim's disk, and execution of arbitrary local programs. This compromises confidentiality and integrity of the affected system and project data. There is no indication of availability impact. No known exploits are reported in the wild at this time.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid exposing the 'rojo serve' HTTP API to untrusted networks or browsers. Restrict access to the API to trusted environments and consider network-level protections to prevent DNS rebinding attacks.