What happened
GitHub Security Advisory GHSA-ccxp-q2w5-27jw and NVD CVE-2026-46409 (CVSS 9.6, Critical) published August 7, 2026, describe the CSRF-to-RCE chain in OpenYak's desktop backend.
Why it matters
This is a classic browser-as-confused-deputy attack against a local AI agent runtime — since agent runtimes hold tool-execution capability, an attacker who merely gets a victim to visit a webpage can pivot into arbitrary command execution on the developer's machine via the agent's own tool-invocation surface.
Attack vector
The OpenYak desktop backend binds an HTTP API to 127.0.0.1:<random port> without server-side Origin validation, loopback authentication, or Content-Type enforcement, and combined with a wildcard CORS policy, a malicious webpage visited by the user can issue cross-origin requests that the browser proxies into the local service, bypassing OS-level network isolation to reach the agent runtime's API and ultimately achieve code execution.
Affected systems
OpenYak desktop (local-first agent runtime) prior to version 1.1.3
Mitigation
Upgrade to OpenYak version 1.1.3 or later, which adds Origin validation, loopback authentication, and proper Content-Type enforcement.