CVE-2026-19352
Full vulnerability record from the local CVENow database.
Description
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.
Severity
LOW
CVSS score
1.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-09 13:16:50.927000
Last modified
2026-10-23 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-19352",
"sourceIdentifier": "[email protected]",
"published": "2026-08-09T13:16:50.927",
"lastModified": "2026-10-23T20:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: \"I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug.\" The CVSS vector reflects the high level of pre-requisites."
},
{
"lang": "es",
"value": "Se determinó una vulnerabilidad en mifi lossless-cut hasta la versión 3.69.0. Afectada por este problema está alguna funcionalidad desconocida del archivo src/main/httpServer.ts del componente Built-in HTTP API Service. La ejecución de una manipulación puede conducir a la falsificación de petición del lado del servidor. El ataque requiere acceso a la red local. Este ataque se caracteriza por una alta complejidad. Se sabe que la explotación es difícil. El exploit ha sido divulgado públicamente y puede ser utilizado. Este parche se llama 260802348955231442c4bae6c2d9d8ede947af0a. Es una buena práctica aplicar un parche para resolver este problema. El mantenedor del proyecto ofrece esta opinión: ’No estoy seguro de que esta sea una vulnerabilidad crítica, porque está detrás de una bandera CLI experimental y el comportamiento de NTLM no es realmente un error de LosslessCut.’ El vector CVSS refleja el alto nivel de prerrequisitos."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "mifi",
"product": "lossless-cut",
"cpes": [
"cpe:2.3:a:mifi:lossless-cut:*:*:*:*:*:*:*:*"
],
"modules": [
"Built-in HTTP API Service"
],
"versions": [
{
"version": "3.0",
"status": "affected"
},
{
"version": "3.1",
"status": "affected"
},
{
"version": "3.2",
"status": "affected"
},
{
"version": "3.3",
"status": "affected"
},
{
"version": "3.4",
"status": "affected"
},
{
"version": "3.5",
"status": "affected"
},
{
"version": "3.6",
"status": "affected"
},
{
"version": "3.7",
"status": "affected"
},
{
"version": "3.8",
"status": "affected"
},
{
"version": "3.9",
"status": "affected"
},
{
"version": "3.10",
"status": "affected"
},
{
"version": "3.11",
"status": "affected"
},
{
"version": "3.12",
"status": "affected"
},
{
"version": "3.13",
"status": "affected"
},
{
"version": "3.14",
"status": "affected"
},
{
"version": "3.15",
"status": "affected"
},
{
"version": "3.16",
"status": "affected"
},
{
"version": "3.17",
"status": "affected"
},
{
"version": "3.18",
"status": "affected"
},
{
"version": "3.19",
"status": "affected"
},
{
"version": "3.20",
"status": "affected"
},
{
"version": "3.21",
"status": "affected"
},
{
"version": "3.22",
"status": "affected"
},
{
"version": "3.23",
"status": "affected"
},
{
"version": "3.24",
"status": "affected"
},
{
"version": "3.25",
"status": "affected"
},
{
"version": "3.26",
"status": "affected"
},
{
"version": "3.27",
"status": "affected"
},
{
"version": "3.28",
"status": "affected"
},
{
"version": "3.29",
"status": "affected"
},
{
"version": "3.30",
"status": "affected"
},
{
"version": "3.31",
"status": "affected"
},
{
"version": "3.32",
"status": "affected"
},
{
"version": "3.33",
"status": "affected"
},
{
"version": "3.34",
"status": "affected"
},
{
"version": "3.35",
"status": "affected"
},
{
"version": "3.36",
"status": "affected"
},
{
"version": "3.37",
"status": "affected"
},
{
"version": "3.38",
"status": "affected"
},
{
"version": "3.39",
"status": "affected"
},
{
"version": "3.40",
"status": "affected"
},
{
"version": "3.41",
"status": "affected"
},
{
"version": "3.42",
"status": "affected"
},
{
"version": "3.43",
"status": "affected"
},
{
"version": "3.44",
"status": "affected"
},
{
"version": "3.45",
"status": "affected"
},
{
"version": "3.46",
"status": "affected"
},
{
"version": "3.47",
"status": "affected"
},
{
"version": "3.48",
"status": "affected"
},
{
"version": "3.49",
"status": "affected"
},
{
"version": "3.50",
"status": "affected"
},
{
"version": "3.51",
"status": "affected"
},
{
"version": "3.52",
"status": "affected"
},
{
"version": "3.53",
"status": "affected"
},
{
"version": "3.54",
"status": "affected"
},
{
"version": "3.55",
"status": "affected"
},
{
"version": "3.56",
"status": "affected"
},
{
"version": "3.57",
"status": "affected"
},
{
"version": "3.58",
"status": "affected"
},
{
"version": "3.59",
"status": "affected"
},
{
"version": "3.60",
"status": "affected"
},
{
"version": "3.61",
"status": "affected"
},
{
"version": "3.62",
"status": "affected"
},
{
"version": "3.63",
"status": "affected"
},
{
"version": "3.64",
"status": "affected"
},
{
"version": "3.65",
"status": "affected"
},
{
"version": "3.66",
"status": "affected"
},
{
"version": "3.67",
"status": "affected"
},
{
"version": "3.68",
"status": "affected"
},
{
"version": "3.69.0",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.3,
"baseSeverity": "LOW",
"attackVector": "ADJACENT",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.1,
"baseSeverity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:A/AC:H/Au:N/C:P/I:N/A:N",
"baseScore": 1.8,
"accessVector": "ADJACENT_NETWORK",
"accessComplexity": "HIGH",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 3.2,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-10T15:28:38.908647Z",
"id": "CVE-2026-19352",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://github.com/mifi/lossless-cut/",
"source": "[email protected]"
},
{
"url": "https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0a",
"source": "[email protected]"
},
{
"url": "https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFe",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19352",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/865910",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387191",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387191/cti",
"source": "[email protected]"
}
]
}