Lavish provides a loopback HTTP server that previously performed no authentication or Host/Origin validation on key routes. A malicious website can employ DNS rebinding to send what appear to be same‑origin requests to the local service. POST /api/sessions allows an attacker to submit a file path of their choosing; the server responds with a session key that grants read access to the requested file. GET /artifact/:key/index.html then delivers the file content, enabling disclosure of any file readable by the server process even without an existing session. An attacker can also enqueue arbitrary text on a live AI agent by POSTing to /api/:key/prompts when the artifact path is known or guessable. The result is remote theft of local files and injection of prompts into the AI agent, potentially altering agent behavior.

The vulnerability affects the Lavish editor from the vendor Kunchenguid, specifically the Lavish‑axi product. All releases prior to version 0.1.43 are vulnerable, which includes versions 0.1.0 through 0.1.42. The issue is resolved in 0.1.43 and later releases.

The CVSS score of 8.1 indicates high severity. The EPSS score is not reported, so the concrete probability of exploitation is unknown, but DNS rebinding is a well‑known technique that many attackers can employ with minimal tooling. The vulnerability is not listed in the CISA KEV catalog, yet the requirement that a user run the local server and visit a malicious site creates a realistic attack window. Successful exploitation grants the attacker local‑file read access and the capability to inject prompts into running AI agent sessions, compromising both confidentiality and integrity of user data.