---
id: RUSTSEC-2026-0279
title: >-
  Rojo development server vulnerable to DNS rebinding, allowing unauthenticated
  read/write access and local program execution
summary: >-
  Rojo development server vulnerable to DNS rebinding, allowing unauthenticated
  read/write access and local program execution
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
vendor: rojo
product: rojo
ecosystem: rust
affected:
  - 'rojo >= 0.0.0-0, < 7.7.0'
patched:
  - rojo 7.7.0
published: '2026-06-02'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T10:00:04.751611780Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0279'
references:
  - url: 'https://crates.io/crates/rojo'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0279.html'
  - url: 'https://github.com/rojo-rbx/rojo/pull/1270'
  - url: >-
      https://github.com/rojo-rbx/rojo/commit/ac6941f05483b0875fda52c7664cd42033db7fa2
tags:
  - osv
  - rust
ingestedAt: '2026-09-07T19:35:14.901Z'
---

## Overview

Rojo's `rojo serve` command starts an unauthenticated HTTP API on localhost
(default port 34872) with no `Host` or `Origin` header validation. While
direct cross-origin `fetch()` requests from a malicious website are blocked by
the browser's default CORS policy, an attacker can use DNS rebinding to bypass
this restriction entirely.
 
The serve API is a two-way sync protocol. Once a DNS rebind is established, a
malicious webpage visited by a developer running `rojo serve` can, without any
further user interaction:
 
- **Read the full project source:** `GET /api/rojo` returns the session ID,
  root instance ID, and project name. `GET /api/read/{id}` enumerates the
  complete instance tree including all script contents, exposing proprietary
  game logic, configuration, and any secrets embedded in source files.
- **Write to project files on disk:** `POST /api/write` pushes changes back
  through Rojo's sync pipeline, allowing an attacker to inject arbitrary Lua
  into the developer's project. If the developer then publishes their game,
  the injected code executes on every player's client — a supply chain attack
  vector.
- **Launch local programs:** `POST /api/open/{id}` calls the OS-level
  `opener::open()` function, which invokes the platform's default handler
  (`open` on macOS, `xdg-open` on Linux, `start` on Windows) for the target
  file.
Exploitation requires only that `rojo serve` is running (the standard Roblox
development workflow) and that the developer visits an attacker-controlled
webpage in any browser on the same machine. The port is a fixed well-known
default (34872), there is no authentication, and no user interaction is needed
beyond the initial page visit.
 
The flaw was corrected in [#1270](https://github.com/rojo-rbx/rojo/pull/1270),
which adds `Host`/`Origin` header validation to reject cross-origin requests,
gates `/api/open` to loopback clients regardless of validated origin, and emits
a warning when the server binds to a non-loopback address

Reported by [Aiden Mohan](https://github.com/AidenMohan).

## Affected packages

- `rojo >= 0.0.0-0, < 7.7.0`

## Remediation

Upgrade to a patched release:

- `rojo 7.7.0`