Skip to content
OpenAdvisories

Package · PyPI

headroom-ai

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-71416

    Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

    Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, a…

    headroomlabs-ai headroom headroom-ai PyPI