CVE-2026-72574

The CVSS 6.1 rating for this Host header injection flaw misrepresents its actual risk profile. The vulnerability lets an unauthenticated attacker poison the base URL from which Pico's default theme loads JavaScript and CSS — but calling this a simple input-validation flaw misses the exploit mechanism entirely. This is not a reflected content issue that disappears when the attacker stops sending headers; it's request-stream poisoning that rewrites how the victim's browser fetches assets on every subsequent page load. A user who visits a target site with an attacker-controlled Host header will silently load JavaScript from an adversary-controlled domain, and that poisoned state persists for the session — or longer, if the URL gets bookmarked. Three factors make this more severe than the score suggests. First, `base_url` is unset by default in Pico, meaning zero configuration or social engineering is required to trigger the vulnerable path. Second, the vulnerability chains X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port in addition to Host, so exploitation is possible even through reverse proxies that sanitize the Host header itself but pass forwarded headers through unchanged. Third, most web application security tooling focuses on reflected parameters and stored content; asset base URL injection slips past scanners that don't simulate full browser rendering chains. The confidentiality impact extends beyond the obvious: any CSRF tokens, session cookies with path scope, or authenticated API calls made by the poisoned page will transit the attacker-controlled domain. Once the browser is loading assets from attacker-controlled JavaScript, every security control relying on same-origin assumptions — CSP headers, cookie attributes, CORS policies — is operating on falsified ground. The attacker's operational requirement drops to zero after the first request; the browser caches the poisoned base URL and silently re-poisons the asset chain on every future visit.

Reviewed through automated stages and approved by a human before publication.