External risk intelligence

Joro Local API Unauthenticated Plugin Upload RCE

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-53649

The vulnerable service is explicitly bound to 127.0.0.1, making it a local-only interface. While it is exploitable via a user's browser, the underlying service itself is not exposed to the public internet or network, conforming to the criteria for local-only, developer-oriented tools that require the operator to be actively running the framework on their local machine.

Missing Authentication

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Joro web exploitation framework. If exploited, an attacker could gain unauthenticated remote code execution by simply tricking an operator into visiting a malicious webpage while the framework is running. The issue has since been patched.

Website tool can be remotely controlled.
Critical remote code execution risk.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can compromise a user by tricking them into visiting a malicious webpage. This page can then interact with the Joro framework running on the user's machine, allowing the attacker to upload and execute a plugin, ultimately leading to remote code execution.

Requires local Joro framework.
Triggers via cross-origin JavaScript.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When Joro's default proxy mode is active, a local API accessible only on 127.0.0.1 could be reached by cross-origin JavaScript. This could allow a malicious website to upload a native plugin and trigger a restart through the operator's browser, leading to remote code execution as the operator's user.

System code execution.
Malicious website visit.
Unauthenticated remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Joro's default proxy mode requires immediate attention to identify and secure affected systems. Application owners and security teams should collaborate to locate instances of Joro, assess their reachability and business criticality, and confirm accountable ownership. Planning remediation based on risk, rather than attempting immediate fixes without understanding the exposure, is the most effective first step.

Application owners should lead remediation efforts.
Verify Joro instances and their network exposure.
Plan and coordinate risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Joro framework?

Joro is a specialized web exploitation framework often used by security researchers and developers to conduct authorized testing. It includes a proxy mode designed to facilitate traffic interception and analysis during these activities.

What does CVE-2026-53649 mean for Joro?

This vulnerability involves several security weaknesses, including missing authentication (CWE-306) and Cross-Site Request Forgery (CWE-352). Essentially, the framework's internal API lacks protection, allowing external web requests to perform sensitive actions like uploading and running malicious plugins.

How can an attacker trigger this vulnerability?

An attacker needs to trick the user into visiting a malicious webpage while the Joro framework is actively running. Simply having the service installed is not enough; the service must be running and the operator must browse to an attacker-controlled site for the code to execute.

Is my machine at risk if Joro is installed?

According to Halo Surface Signal, this risk is very unlikely because the service binds only to the local 127.0.0.1 address, meaning it is not exposed directly to the public internet. However, users should remain cautious since the browser can act as a bridge for malicious websites to reach that local interface.

What steps should I take if I use Joro?

The most effective way to secure your environment is to update Joro to version 1.1.1 or later. You should also verify where you have the framework installed and ensure that only trusted individuals have access to the machine while the service is running.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.