---
id: CVE-2026-54565
title: rhwp is an HWP viewer and editor implemented in Rust and WebAssembly
summary: >-
  rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to
  rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser
  extensions use an all-URLs host permission to detect HWP and HWPX links on
  visited pages,…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-359
  - CWE-918
  - CWE-1385
vendor: edwardkim
product: rhwp
affected:
  - rhwp < 0.7.15
published: '2026-09-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T22:16:56.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54565'
references:
  - url: >-
      https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9
    label: security-advisories@github.com
  - url: 'https://github.com/edwardkim/rhwp/releases/tag/v0.7.15'
    label: security-advisories@github.com
  - url: 'https://github.com/edwardkim/rhwp/security/advisories/GHSA-j972-m9fh-g22m'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.0013
epssPercentile: 0.02974
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T21:13:29.847940Z'
ingestedAt: '2026-09-17T20:28:02.780Z'
---

## Overview

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.