Description
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch Update
AI Analysis

Impact

A flaw in the Local HTTP Service (src/main/api/index.ts) of massCode 5.10 permits remote attackers to retrieve sensitive data without proper authentication, leading to a disclosure of information. The weakness matches CWE-200 (Information Exposure) and CWE-284 (Improper Access Control), and the publicly disclosed exploit can be triggered through simple HTTP requests.

Affected Systems

The vulnerability is identified only for massCodeIO massCode version 5.10. No other affected releases are listed, but any earlier or unpatched versions containing the same code may be vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the existence of a public exploit and the lack of an explicit patch release suggest that it may be exploited by remote actors over HTTP.

Generated by OpenCVE AI on October 22, 2026 at 05:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch commit d25d8fa3f5a1e34285c8634f18729650c0c05cda or upgrade to the latest massCode release that incorporates the fix.
  • Restrict network exposure to the Local HTTP Service by implementing firewall rules or disabling the service if not needed.
  • Perform regular vulnerability scans and penetration tests focused on exposed HTTP endpoints to detect similar information‑disclosure issues early.

Generated by OpenCVE AI on October 22, 2026 at 05:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
Title massCodeIO massCode Local HTTP Service index.ts information disclosure
First Time appeared Masscode
Masscode masscode
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:masscode:masscode:*:*:*:*:*:*:*:*
Vendors & Products Masscode
Masscode masscode
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Masscode Masscode
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T02:10:12.997Z

Reserved: 2026-10-21T18:13:30.056Z

Link: CVE-2026-114574

cve-icon Vulnrichment

Updated: 2026-10-28T02:10:08.999Z

cve-icon NVD

Status : Deferred

Published: 2026-10-22T01:16:58.337

Modified: 2026-10-28T03:17:09.970

Link: CVE-2026-114574

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T09:30:02Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control