Reasonix CLI: DNS rebinding to full agent control via serve

1. Upgrade the Reasonix CLI to 1.34.0 or later (npm i -g reasonix@latest).
2. Until you upgrade, do not leave reasonix serve running while you browse, and consider setting serve.auth_mode to token or password.

reasonix serve runs an unauthenticated local HTTP API (default 127.0.0.1:8787) that drives the coding agent. Before 1.34.0 it checked neither the Host nor the Origin header, and its only cross-site guard was a requirement for Content-Type: application/json. DNS rebinding turns a visited web page into a same-origin client of that API, which removes the guard: the page can switch the session to auto-approve every tool, submit an agent turn (code execution as the user) and read the full transcript. Separately, the write_file, edit_file and multi_edit previews read a model-supplied absolute path without the workspace confinement the other tools apply.

reasonix (npm), the 1.x Go CLI, before 1.34.0, with reasonix serve running in its default configuration (127.0.0.1:8787, serve.auth_mode unset, which means no authentication). The preview issue affects the same versions. The 2.x Reasonix Studio line was not reviewed.

• (a) DNS rebinding, high. The application/json requirement stops a plain cross-origin request, because the browser must send a CORS preflight that the server never answers. After DNS rebinding, the attacker's page is same-origin with the local server, so no preflight is needed and responses are readable. The page can then call POST /bypass or POST /tool-approval-mode to auto-approve all tools, POST /submit to run an agent turn whose shell and file tools now run without a human gate, approve pending tool calls, and read /history, /status and the session list.
• (b) Preview path escape, medium. The previews for write_file, edit_file and multi_edit read the target file with a bare read and skip the confinePreview() check that delete_range and delete_symbol make, so a model-supplied absolute path is read outside the workspace and past the [secrets] protect_sensitive_files denylist.

Browser mitigation. Chrome's Local Network Access prompt raises the bar for (a) when the user denies it. Other browsers were not verified.

• internal/serve/serve.go: handler() wraps the routes as logMiddleware(s.auth.middleware(csrfGuard(mux))), and csrfGuard is the only cross-site check
• internal/serve/auth.go: the default auth mode none passes every request through
• internal/cli/cli.go: --addr defaults to 127.0.0.1:8787
• write_file / edit_file / multi_edit Preview() in internal/tool/builtin/ omit confinePreview()

The fix adds internal/serve/hostguard.go and internal/tool/builtin/confine.go changes in #9599.

• #9599 puts a Host allowlist in front of the serve routes (requests with a foreign Host get HTTP 421) and closes the plain-HTTP auth warning gap.
• The same PR routes the three previews through the workspace confinement boundary.

Look for requests to the serve port (default 8787) whose Host header names something other than 127.0.0.1, localhost or [::1], and for unexpected POST /bypass, /tool-approval-mode or /submit calls in serve logs. A working exploit is withheld.

1. 2026-08-03Reported privately via GitHub PVR (GHSA-5gf8-hg54-m9q9), with suggested fixes.
2. 2026-08-30Maintainer merges #9599 (Host allowlist and preview confinement); reasonix 1.34.0 released the same day.
3. 2026-09-02We confirm the fix covers both findings and note it on the advisory; the maintainer closes the advisory without publishing it.
4. 2026-09-23CVE IDs requested from MITRE.
5. 2026-10-09Public write-up.

Finder: Aaron Elijah Mars of Aeon. Tool: Aeon.

• Fix PR (merged 2026-08-30): esengine/DeepSeek-Reasonix#9599
• Fixed release: reasonix 1.34.0
• GitHub advisory: GHSA-5gf8-hg54-m9q9 (private; closed, not published)
• CVE: pending (requested from MITRE)
• Affected repository: esengine/DeepSeek-Reasonix