Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Arduino Create Agent (github.com/arduino/arduino-create-agent) versions before 1.3.3 are vulnerable. An attacker who can send HTTP requests to the localhost interface, or who can bypass the CORS configuration, can send a crafted POST request to the /v2/pkgs/tools/installed endpoint and gain the privileges of the user running the service. Upgrade to version 1.3.3.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.3 | High | 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0022, the 12th percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:44 UTC First seen by agentprime
- 31 Oct 2026, 14:44 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-4x5q-q7wc-q22p
- OSV: GHSA-4x5q-q7wc-q22p
- github.com/arduino/arduino-create-agent/security/advisories/GHSA-4x5q-q7wc-q22p
- nvd.nist.gov/vuln/detail/CVE-2023-43800
- github.com/arduino/arduino-create-agent
- github.com/arduino/arduino-create-agent/releases/tag/1.3.3
- www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide