PT-2026-60227 · Unknown · Lightpanda

CVE-2026-52843 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lightpanda versions prior to 0.2.9

Description Lightpanda, a headless browser for AI and automation, fails to properly handle credential settings during HTTP requests. The fetch() and XMLHttpRequest functions unconditionally attach session cookies to every request, ignoring the credentials property (specifically the omit, same-origin, and include values) and the XMLHttpRequest.withCredentials property. This behavior allows an attacker-controlled origin within a session to perform authenticated cross-origin requests against a target origin.

Recommendations Update to version 0.2.9.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-52843

GHSA-36MM-V3C2-24CC

Affected Products

Lightpanda

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52843.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-52843 · Security Note
• https://osv.dev/vulnerability/CVE-2026-52843 · Vendor Advisory
• https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76 · Note
• https://github.com/lightpanda-io/browser/pull/2155 · Note
• https://github.com/lightpanda-io/browser/releases/tag/0.2.9 · Note
• https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc · Note