The vulnerability exists in Rojo’s deprecated HTTP API used by the "rojo serve" command, which listens on port 34872. The service accepts HTTP requests without validating the Host or Origin headers, enabling a DNS rebinding attack. An attacker can host a malicious web page that, after a user visits the page, performs DNS resolution tricks to make the browser appear to be communicating with the local Rojo server. The attacker can then read any files that the Rojo process can access, write arbitrary code to disk, and launch local programs through the Rojo API’s opener::open() function. This effectively grants the attacker code execution and file‑system modification privileges on the host running Rojo, with no further user interaction required beyond visiting the malicious page.

The affected system is the Rojo code‑generation tool, specifically the "rojo serve" HTTP API. It is distributed by the rojo‑rbx project. The product is a local development server that developers run to test Rojo code; the vulnerability applies to all installations running the default configuration without additional host‑validation logic. No explicit version range is listed in the CNA data, so any version exposing the unvalidated API is considered affected. The developer’s network should be aware that any machine running an unpatched version on the default port 34872 is exposed to external attack.

The CVSS score of 8.1 classifies this flaw as high severity, with a normal impact on both confidentiality and integrity. Although the EPSS score is unavailable, the lack of mitigation requirements and the public disclosure of a code example in the referenced pull request imply that an attacker can feasibly construct a DNS‑rebinding payload. The attack would require a victim to visit a malicious web page hosted on an attacker‑controlled domain; the page would then attempt to resolve the local Rojo server’s address via DNS rebinding, tricking the browser into sending requests to localhost. If successful, the attacker gains the privileges of the Rojo process, allowing arbitrary file reads, writes, and execution of local programs through the API. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild, but the high CVSS score warrants timely remediation.