LoopX is a lightweight state kernel for loop engineering. Beginning with version 0.0.1, the serve-status component sends an Access-Control-Allow-Origin:* header for all unauthenticated responses on local-loopback ports. A malicious webpage can trigger cross‑origin requests to endpoints such as /status.json, /review‑material, /, and /control‑plane/configure‑goal/dry‑run. The result is exposure of control‑plane state, goal and run information, local absolute paths, and private Markdown files stored under goal roots. The flaw does not permit cross‑origin writes or arbitrary file reads, but it does provide the attacker with sensitive data and internal paths, constituting a confidentiality breach.

The vulnerability impacts LoopX, a product from the huangruiteng vendor. Versions from 0.0.1 through 0.4.4 are affected. Version 0.4.5, released in October 2026, contains the fix, so any deployment using 0.4.5 or later is no longer vulnerable. Administrators should verify the installed LoopX version and apply the update if necessary.

The CVSS score of 7.1 reflects a medium severity due to partial confidentiality impact and lack of authentication. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by an external attacker who convinces a user’s browser to contact the local LoopX interface through a malicious webpage. Because the wildcard CORS header permits any origin, the browser can read the returned JSON data and private files without requiring any prior credentials. The simple exploitation path – an HTML link or script that targets the predictable local ports – means that a knowledgeable attacker can obtain sensitive configuration and development content with minimal effort.