CVE-2026-124587 | BDVDB-2026-402433 Detail
elizaOSeliza
Description#
A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
References#
- https://vuldb.com/vuln/433011
- https://vuldb.com/vuln/433011/cti
- https://vuldb.com/cve/CVE-2026-124587
- https://vuldb.com/submit/1039543
- https://github.com/elizaOS/eliza/issues/33034
- https://github.com/elizaOS/eliza/pull/33142
- https://github.com/elizaOS/eliza/commit/cf6fa193017e70884e01c5bb7890f74b6b2b79d2
- https://github.com/elizaOS/eliza/
Exploit#
History#
- Version 1Record published in the CVE List.