Description
SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its  do_POST  handler in  tools/SharpEmu.DebuggerFrontend/debugger_frontend.py  does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The  _read_json_body()  function also accepts JSON sent with browser-simple content types instead of requiring  application/json . A malicious page that can reach the loopback listener can send cross-origin requests to  /api/launch ,  /api/command , and  /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The  /api/launch  endpoint accepts an attacker-selected  emulatorPath  if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing  ebootPath . The  /api/command  endpoint exposes debugger operations, including  write-memory ,  set-register , and  continue . The  /api/connect  endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1
Published: 2026-11-04
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via CSRF
Action: Immediate Patch
AI Analysis

Impact

SharpEmu, an experimental PlayStation 5 emulator for Windows and Linux, had a debugger frontend with a local HTTP API that accepted requests without authentication, CSRF protection, or proper JSON content type validation. The API endpoints /api/launch, /api/command, and /api/connect allow an attacker to specify an arbitrary executable path, manipulate memory and registers, and initiate outbound network connections. If an attacker can reach the 127.0.0.1:8765 endpoint, they can cause the emulator to execute any file present on the host, control the debugged process, or interact with network services visible to the host. This results in arbitrary code execution with the privileges of the user running the emulator.

Affected Systems

The vulnerability affects the SharpEmu emulator (sharpemu:sharpemu) version 0.0.3-release.3 and earlier. The issue is present only when the repository‑provided debugger frontend is run; it is not included in the official release archives.

Risk and Exploitability

The CVSS score of 8.3 indicates a high severity vulnerability. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves a local attacker or a remote attacker able to reach the loopback interface through techniques such as DNS rebinding or exploiting browsers that allow local‑network requests from public origins. The absence of authentication and CSRF protection makes exploitation straightforward for anyone who can send HTTP requests to 127.0.0.1:8765.

Generated by OpenCVE AI on November 4, 2026 at 18:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply SharpEmu v0.0.3-release.3-patch.1 or later, which disables the unauthenticated 127.0.0.1:8765 endpoint and adds CSRF protection (CWE‑352).
  • If updating is not yet possible, stop the debugger frontend or remove the HTTP API component to eliminate unauthenticated local interfaces (CWE‑306).
  • Block inbound traffic to port 8765 with a firewall or network policy, preventing exploitation of the open API by external attackers (CWE‑306).
  • Configure the HTTP server to accept only application/json request bodies, thereby enforcing proper content type validation and limiting the types of requests the API accepts.

Generated by OpenCVE AI on November 4, 2026 at 18:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
Description SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its  do_POST  handler in  tools/SharpEmu.DebuggerFrontend/debugger_frontend.py  does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The  _read_json_body()  function also accepts JSON sent with browser-simple content types instead of requiring  application/json . A malicious page that can reach the loopback listener can send cross-origin requests to  /api/launch ,  /api/command , and  /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The  /api/launch  endpoint accepts an attacker-selected  emulatorPath  if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing  ebootPath . The  /api/command  endpoint exposes debugger operations, including  write-memory ,  set-register , and  continue . The  /api/connect  endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1
Title SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
Weaknesses CWE-306
CWE-346
CWE-350
CWE-352
CWE-749
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-04T15:24:16.625Z

Reserved: 2026-09-16T16:22:31.542Z

Link: CVE-2026-92704

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T16:17:55.097

Modified: 2026-11-04T16:17:55.097

Link: CVE-2026-92704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T18:15:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function

  • CWE-346

    Origin Validation Error

  • CWE-350

    Reliance on Reverse DNS Resolution for a Security-Critical Action

  • CWE-352

    Cross-Site Request Forgery (CSRF)

  • CWE-749

    Exposed Dangerous Method or Function