A critical vulnerability in OpenYak allows a malicious website to communicate with the application's local API and execute commands on the user's computer. The OpenYak RCE affects versions up to 1.1.2 and requires an immediate upgrade.
OpenYak is a local AI assistant for desktops. The application can read files, maintain conversations, and perform tasks via a local server. According to the official advisory on GitHub, the vulnerability has a CVSS score of 10.0 and was fixed in version 1.1.3.
See also: NanoClaw: Serious vulnerability causes file leak
How OpenYak RCE is evolving
The vulnerable component is the local HTTP API that runs at 127.0.0.1 and uses a random port, often 19141. Although the service is not directly exposed to the internet, the browser can act as an intermediary and send requests to the loopback environment.
The API does not verify the origin of requests, does not require authentication for local connections, and accepts any origin through a very open CORS policy. It also does not strictly enforce content type. Thus, a page that a user opens can generate cross-origin requests without any apparent warning.
The advisory clarifies that a random port is not a meaningful defense, as JavaScript can scan ports on the local computer. The attack requires OpenYak to be running and the user to visit the malicious page, without any further action or login to their account.
See also: A malicious website can compromise Tor Browser
Access to commands and data
The chain leading to the OpenYak RCE reaches the OpenYak task execution engine. When the permission_presets.bash=true allows shell commands, the web page can cause arbitrary code execution with the user's privileges. The execution is not confined to an isolated environment, so the impact depends on the access of the specific account.
The consequences are not limited to executing commands. The announcement states that the attacker can terminate the service, read account information, and extract chat history. Such histories may contain passwords, source code snippets, or customer data.
For a developer, the breach can extend to SSH keys, cloud credentials, repositories, and browser profiles. The assessment should not be based solely on whether OpenYak uses local models, as the issue is about the application's access to the operating system and its files.
Version 1.1.3 is the necessary fix
Users should upgrade OpenYak to version 1.1.3 or later. The project team says there is no fix that fully fixes the issue, so upgrading is the only complete solution. Those who cannot implement it immediately should close the application when not in use.
The report focuses on developer workstations and explains why the OpenYak RCE is significant, where an AI program has access to files and development tools. Even if remote access is not enabled, the local API remains a critical checkpoint because browser requests can reach it from different origins.
The fix adds origin checking for requests that change data, restricts CORS policy to legitimate OpenYak origins, and enforces allowed content types. System administrators should also check logs for unexpected calls to the local API and consider any credentials that were present in conversations or work files as exposed.
See also: Critical vulnerability alert in ServiceNow AI Platform
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
OpenYak shows that a service that only listens on loopback is not automatically secure. The SecNews technical team recommends an immediate upgrade, temporary shutdown of the application where this is not possible, and re-checking any secrets that may have been available in the local environment .
