rojo-rbx vulnerabilities and threats

Rojo's 'rojo serve' HTTP API, which listens on the default port 34872, lacks validation of the Host and Origin headers. This vulnerability allows DNS rebinding attacks where a malicious webpage can access all project source code, write malicious files to disk, and execute local programs via opener::open() without additional user interaction beyond visiting the page. The vulnerability affects versions from 0 up to but not including 7.7.0. It has a high severity with a CVSS score of 8.1.