CVE-2026-54565

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9
https://github.com/edwardkim/rhwp/releases/tag/v0.7.15
https://github.com/edwardkim/rhwp/security/advisories/GHSA-j972-m9fh-g22m

Configurations

No configuration.

History

17 Sep 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 21:17

Updated : 2026-09-24 21:25

NVD link : CVE-2026-54565

Mitre link : CVE-2026-54565

CVE.ORG link : CVE-2026-54565

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

CWE-918

Server-Side Request Forgery (SSRF)

CWE-1385

Missing Origin Validation in WebSockets

{"id": "CVE-2026-54565", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54565", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T21:13:29.847940Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "edwardkim", "product": "rhwp", "versions": [{"status": "affected", "version": "< 0.7.15"}]}]}], "published": "2026-09-17T21:17:16.543", "references": [{"url": "https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9", "source": "security-advisories@github.com"}, {"url": "https://github.com/edwardkim/rhwp/releases/tag/v0.7.15", "source": "security-advisories@github.com"}, {"url": "https://github.com/edwardkim/rhwp/security/advisories/GHSA-j972-m9fh-g22m", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-359"}, {"lang": "en", "value": "CWE-918"}, {"lang": "en", "value": "CWE-1385"}]}], "descriptions": [{"lang": "en", "value": "rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4."}], "lastModified": "2026-09-24T21:25:27.050", "sourceIdentifier": "security-advisories@github.com"}