important · Desktop — RCE
A LAN observer can turn Maestro’s plaintext Live Mode URL into command execution as the desktop user.
Affects
Maestro, a cross-platform desktop application for controlling AI coding agents and terminals.
Live Mode binds an HTTP and WebSocket control server to 0.0.0.0, embeds bearer tokens in URLs and exposes a terminal-capable API.
Detail and 1 source
A fixed version is published, but the fix itself was not inspected for this brief.