CVE-2026-97875 rojo-rbx CVE debrief

Who should care

Rojo users and administrators should assess exposure and prioritize securing the 'rojo serve' API to prevent potential DNS rebinding attacks. This includes reviewing and updating Rojo installations, implementing proper Host/Origin header validation, and restricting access to trusted sources only. Security teams and vulnerability management teams should also review the official advisory and plan vendor-supported updates or mitigations where exposure is is

Why it matters

CVE-2026-97875 is a high-severity vulnerability in Rojo's 'rojo serve' HTTP API that allows malicious webpages to perform DNS rebinding attacks. Defenders should prioritize securing Rojo installations to prevent potential unauthorized access and code execution.

• Potential unauthorized access to project source code
• Possible writing of malicious code to files on disk
• Launching of local programs without user interaction
• Requires verification of affected versions and remediation steps

Technical summary

The Rojo 'rojo serve' HTTP API, running on default port 34872, lacks Host/Origin header validation. This vulnerability allows a malicious webpage to perform DNS rebinding attacks, potentially leading to unauthorized access to project source code, writing malicious code to files on disk, and launching local programs via opener::open() without user interaction. The vulnerability is confirmed by CVE Program and NVD records, and defenders should prioritize securing Rojo installations to prevent potential DNS rebinding attacks.

Defensive priority

High priority for Rojo users

Recommended defensive actions

• Review and update Rojo installations to ensure 'rojo serve' API is properly secured
• Implement proper Host/Origin header validation for 'rojo serve' API
• Restrict access to 'rojo serve' API to trusted sources only
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

CVE Program and NVD records confirm Rojo's 'rojo serve' HTTP API vulnerability to DNS rebinding, allowing malicious webpages to read project source, write files, and launch local programs. The vulnerability is due to a lack of Host/Origin header validation in the 'rojo serve' API. Defenders should verify affected versions, review the official advisory, and implement proper Host/Origin header validation for the 'rojo serve' API.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.