CVE-2026-52843Lightpanda: fetch() and XMLHttpRequest attach session cookies to cross-origin requests regardless of credentials mode
Updated under an hour ago ()
Does this affect you?
It affects lightpanda-io browser. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
- CVSS
- 9.3 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- Weakness (CWE)
- CWE-346
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Jul 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
lightpanda-io browser lightpanda_io:browser (from the name) | before 0.2.9 | CNA record |
References
- https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24ccx-refsource-confirm
- https://github.com/lightpanda-io/browser/pull/2155x-refsource-misc
- https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76x-refsource-misc
- https://github.com/lightpanda-io/browser/releases/tag/0.2.9x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.