CVE-2026-107337 — Cross-Site Request Forgery in Malcolm
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's br…
Published: 2026-10-08 · CVSS: 7.1 · CVSS 3.1
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7