krita

This module creates a localhost TCP/HTTP-like service that provides an unauthenticated /run capability to execute arbitrary attacker-controlled Python code in the Krita application process (via exec) and optionally execute code loaded from an attacker-supplied filesystem path (open + exec). It returns stdout/stderr and errors back to the caller, enabling reliable exploitation. The only “access control” is a weak, header-based cross-origin heuristic, which is not a substitute for authentication/authorization. While bound to 127.0.0.1, the functionality constitutes a high-risk local RCE primitive with direct access to Krita objects.