CVE-2026-6874: ericc-ch copilot-api reliance on reverse DNS in /token Host handling

Summary

CVE-2026-6874 affects ericc-ch copilot-api up to 0.7.0. A manipulated Host argument sent to the /token endpoint of the Header Handler component can lead to reliance on reverse DNS resolution (CWE-350). The attack can be performed remotely, the exploit has been publicly disclosed, and the vendor did not respond to early contact. CVSS 4.0 base score is 5.3 (MEDIUM), assessed by VulDB; NIST has not yet provided an assessment.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Coding assistants

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News