Textream's local WebSocket server did not validate the Origin header. A malicious web page visited by the user could silently connect to it and send commands.
Summary
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server accepted connections from any origin without validating the HTTP Origin header during the handshake.
Impact
A malicious web page visited in the same browser session could silently connect to the local WebSocket server and send arbitrary commands.
Fix
Update to 1.5.1 or later. If you write your own WebSocket server, compare the Origin header against an allowlist during the handshake and reject anything that doesn't match.
References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28403
- GitHub Security Advisory: https://github.com/f/textream/security/advisories/GHSA-wr3v-x247-337w
- Fix commit: https://github.com/f/textream/commit/f5ebad82750b9313386c34af8f0ede50c213a8a0
- CVE record (MITRE): https://www.cve.org/CVERecord?id=CVE-2026-28403
- CVE record (Feedly): https://feedly.com/cve/CVE-2026-28403
Originally published at iamcanturk.dev.
Top comments (0)