CVE-2026-7643 ChatGPTNextWeb NextChat跨域策略配置错误漏洞

import requests # Proof of Concept for CVE-2026-7643 # This script checks if the target API allows arbitrary origins (CORS misconfiguration) target_url = "http://target-host/api/v1/config" malicious_origin = "http://evil.com" headers = { "Origin": malicious_origin, "User-Agent": "PoC-Scanner/1.0" } try: response = requests.get(target_url, headers=headers) # Check if Access-Control-Allow-Origin reflects the malicious origin or is * acao = response.headers.get("Access-Control-Allow-Origin") if acao == malicious_origin or acao == "*": print(f"[+] Vulnerability Detected! Server allows origin: {acao}") else: print("[-] Vulnerability not detected or strict CORS policy in place.") except Exception as e: print(f"Error: {e}")