CVE-2026-54565 Details
Description
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
A vulnerability in the rhwp browser extension for Chrome and Firefox, prior to version 0.2.4, allows untrusted web pages to exploit the extension's privileges. The extension, which has an all-URLs host permission, can be tricked into fetching local or private-network HWP files and extracting thumbnail previews. This is possible because the extension's service workers do not properly validate the sender of the fetch requests or the URLs being accessed. As a result, an attacker can inject links to private resources that the extension will fetch and process, leaking data back to the untrusted page.
Users can update to rhwp version 0.7.15 and the rhwp Chrome or Firefox extension version 0.2.4, which include the necessary fixes. Instructions for downloading the updated versions are available on the rhwp GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9 | [email protected] | Source CodeVendor |
| https://github.com/edwardkim/rhwp/releases/tag/v0.7.15 | [email protected] | Release NotesVendor |
| https://github.com/edwardkim/rhwp/security/advisories/GHSA-j972-m9fh-g22m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1385 | Missing Origin Validation in WebSockets | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| edwardkim rhwp | < 0.7.15 (semver) |
CPE
Remediation
| |
| edwardkim rhwp-chrome | < 0.2.4 (semver) |
CPE
Remediation
| |
| edwardkim rhwp-firefox | < 0.2.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |