What happened
Prior to 0.1.43, the lavish-axi loopback server exposed unauthenticated session, artifact, prompt, and polling routes without Host/Origin validation. A website the user visits can exploit DNS rebinding to reach the local service, set an arbitrary file path, and have the server return that file's contents; with a known/guessed artifact path it can also inject prompts into a live agent session.
Why it matters
This is a prompt-injection-into-an-active-agent-session class with a working browser-based path (DNS rebinding), plus arbitrary local file disclosure — a real risk for anyone running an AI-artifact/agent editor that renders untrusted pages while an agent session is active.
Attack vector
The loopback HTTP server does not authenticate requests or validate Host/Origin on session, artifact, prompt, and polling routes (CWE-306/CWE-346). DNS rebinding lets a malicious site send same-origin browser requests; POST /api/sessions accepts a caller-chosen file path and GET /artifact/:key/index.html returns the file contents — enabling arbitrary file disclosure — and an attacker can also queue text through POST /api/:key/prompts into an active agent session.
Affected systems
lavish-axi before 0.1.43
Mitigation
Upgrade to lavish-axi 0.1.43 (which adds Origin/Host validation and authentication).