Ericc-ch Copilot-api vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ericc-ch Copilot-api: 2 record(s), with affected versions and fixes.
CVE-2026-6874
Medium · 4.3
CWE-350 Apr 22, 2026
ericc-ch copilot-api Header token dns rebinding
A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resolution. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-6662
High · 7.3
CWE-346 Apr 20, 2026
ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy
A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src/server.ts of the component Token Endpoint. Performing a manipulation results in permissive cross-domain policy with untrusted domains. It is possible to initiate the attack remotely. The exploit has been made public and could be used.