Impact

What kind of vulnerability is it? Who is impacted?

This vulnerability impacts everyone running ActivityWatch, and gives the attacker full access to the ActivityWatch REST API.

Patches

Has the problem been patched? What versions should users upgrade to?

Users should upgrade to v0.12.0b2 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Block DNS lookups that resolve to 127.0.0.1.