Summary
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server accepted connections from any origin without validating the HTTP Origin header during the handshake.
Impact
A malicious web page visited in the same browser session could silently connect to the local WebSocket server and send arbitrary commands.
Fix
Update to 1.5.1 or later. If you write your own WebSocket server, compare the Origin header against an allowlist during the handshake and reject anything that doesn’t match.
