RUSTSEC-2026-0279: Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

What to do

1. See which version you have: cargo tree -i rojo (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p rojo. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example rojo = "7.7.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Rojo's rojo serve command starts an unauthenticated HTTP API on localhost (default port 34872) with no Host or Origin header validation. While direct cross-origin fetch() requests from a malicious website are blocked by the browser's default CORS policy, an attacker can use DNS rebinding to bypass this restriction entirely.

The serve API is a two-way sync protocol. Once a DNS rebind is established, a malicious webpage visited by a developer running rojo serve can, without any further user interaction:

Exploitation requires only that rojo serve is running (the standard Roblox development workflow) and that the developer visits an attacker-controlled webpage in any browser on the same machine. The port is a fixed well-known default (34872), there is no authentication, and no user interaction is needed beyond the initial page visit.

• **Read the full project source:** GET /api/rojo returns the session ID, root instance ID, and project name. GET /api/read/{id} enumerates the complete instance tree including all script contents, exposing proprietary game logic, configuration, and any secrets embedded in source files.
• **Write to project files on disk:** POST /api/write pushes changes back through Rojo's sync pipeline, allowing an attacker to inject arbitrary Lua into the developer's project. If the developer then publishes their game, the injected code executes on every player's client , a supply chain attack vector.
• **Launch local programs:** POST /api/open/{id} calls the OS-level opener::open() function, which invokes the platform's default handler (open on macOS, xdg-open on Linux, start on Windows) for the target file.

The flaw was corrected in #1270, which adds Host/Origin header validation to reject cross-origin requests, gates /api/open to loopback clients regardless of validated origin, and emits a warning when the server binds to a non-loopback address

Reported by Aiden Mohan.

References

• Package: crates.io/crates/rojo
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0279.html
• Web: github.com/rojo-rbx/rojo/pull/1270
• Web: github.com/rojo-rbx/rojo/commit/ac6941f05483b0875fda52c7664cd42033db7fa2

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.