AIKIDO-2026-594484
encore.dev is vulnerable to Cross-Site WebSocket Hijacking
43
CVE Score
Medium
Cross-Site WebSocket Hijacking
TL;DR
The local Encore developer dashboard exposes a JSON-RPC API over a WebSocket served by the CLI daemon on the developer's machine without validating the request Origin, so connections from any web origin are accepted. While a developer runs Encore locally, a website they visit can open a cross-origin WebSocket to the daemon and read information available through the dashboard. This does not reach Encore Cloud or production data, and modern browsers further limit the attack with a local-network permission prompt. The fix validates the WebSocket Origin and only accepts connections from loopback addresses.
How do I fix this?
Upgrade the encore.dev library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the local Encore developer dashboard while browsing untrusted sites in the same browser profile.
Package
Versions
0.0.1 - 1.57.5
Fixed in 1.57.13Background info
encore.dev is vulnerable to Cross-Site WebSocket Hijacking in versions 0.0.1 - 1.57.5.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.