CVE-2026-52843 Details
Description
Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin. This issue is fixed in version 0.2.9.
A vulnerability in Lightpanda prior to version 0.2.9 allows session cookies to be unconditionally attached to all HTTP requests made with fetch() and XMLHttpRequest. This behavior ignores the specified credentials mode, including 'omit', 'same-origin', and 'include', as well as XMLHttpRequest.withCredentials. As a result, an attacker-controlled origin could issue authenticated cross-origin requests to a victim origin, using cookies from the Lightpanda session.
Users can upgrade to Lightpanda version 0.2.9 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lightpanda-io/browser/commit/2cdaac780bed65db98bbb6ed2ad5bc6011863c76 | [email protected] | Source CodeVendor |
| https://github.com/lightpanda-io/browser/pull/2155 | [email protected] | Source CodeVendor |
| https://github.com/lightpanda-io/browser/releases/tag/0.2.9 | [email protected] | Release NotesVendor |
| https://github.com/lightpanda-io/browser/security/advisories/GHSA-36mm-v3c2-24cc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lightpanda | < 0.2.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |