CVE-2026-114574 massCodeIO CVE debrief

Who should care

Defenders responsible for massCodeIO massCode installations, especially those using version 5.10, should assess their exposure and apply the patch to prevent potential information disclosure. This vulnerability, while of low severity, still poses a risk and should be addressed in the context of overall vulnerability management.

Why it matters

CVE-2026-114574 is a low-severity vulnerability in massCodeIO massCode 5.10 that allows for remote information disclosure. Defenders should care because it requires patching to prevent potential exploitation, and its remote exploitability increases the attack surface. The impact is limited by its low CVSS score, but it still necessitates attention in vulnerability management.

• Potential information disclosure requires verification of affected versions and exposure.
• Patching is necessary to prevent exploitation.
• Remote exploitability increases the attack surface.
• Verification of Local HTTP Service configurations is necessary.

Technical summary

The vulnerability is located in the src/main/api/index.ts file of the Local HTTP Service component in massCodeIO massCode 5.10. It allows for remote information disclosure and has a CVSS score of 2.1, classified as LOW severity. The exploit has been publicly disclosed, and a patch (d25d8fa3f5a1e34285c8634f18729650c0c05cda) is available. Defenders should prioritize patching this vulnerability to prevent potential information disclosure. Given the low CVSS score of 2.1, the urgency might be lower compared to higher-severity vulnerabilities, but it still requires attention, especially in environments where massCodeIO massCode 5.10 is used. The CVE record and NVD detail page provide information about this details.

Defensive priority

Defenders should prioritize patching this vulnerability to prevent potential information disclosure. Given the low CVSS score of 2.1, the urgency might be lower compared to higher-severity vulnerabilities, but it still requires attention, especially in environments where massCodeIO massCode 5.10 is used.

Recommended defensive actions

• Apply the patch (d25d8fa3f5a1e34285c8634f18729650c0c05cda) to the affected massCodeIO massCode 5.10 installation.
• Review and update the Local HTTP Service configuration to minimize exposure.
• Monitor for any suspicious activity related to information disclosure.
• Verify affected massCodeIO massCode 5.10 deployments exist in managed environments.
• Review compensating controls for exposed systems while remediation is scheduled.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information about this vulnerability. The CVE Program and NIST National Vulnerability Database are the sources of this information. Additional details can be found in various GitHub references related to massCodeIO massCode.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.