Medium severity · published Oct 21, 2026
CVE-2026-114574
massCodeIO massCode Local HTTP Service index.ts information disclosure
New
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
massCode · massCodeIO
5.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114574
github.com
https://github.com/massCodeIO/massCode/
github.com
https://github.com/massCodeIO/massCode/commit/d25d8fa3f5a1e34285c8634f18729650c0c05cda
github.com
https://github.com/massCodeIO/massCode/issues/966
github.com
https://github.com/massCodeIO/massCode/pull/912
vuldb.com
https://vuldb.com/cve/CVE-2026-114574
vuldb.com
https://vuldb.com/submit/1021288
More from massCode
6.1
CVE-2020-8548
massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true)