GCVE-110-VULN-PYPI-2026-000630

If you run aimarket-platon 0.1.0 through 0.1.3 without PLATON_STEER_TOKEN and outside production mode, which is the default, anyone who can reach its port can steer and project the shared world (POST /api/steer, /api/project, the beacon checkpoint, the platon.steer@v1 and platon.project@v1 capabilities behind POST /ai-market/invoke, and the websocket writes): main._write_authorized returns true for every request, and the server binds 0.0.0.0 by default (config.Settings.host), so a developer who runs it locally opens it to their network. Source version 0.1.4 (commit 1c8944d, never published to PyPI) accepts only callers it judges local, which a reverse proxy on the same host passes. Fixed in 0.1.5 for callers on other hosts and for a proxy that runs as a different user on Linux: without a token, writes need a loopback caller whose socket belongs to the server's user, unless PLATON_PUBLIC_WRITES=1 opens them on purpose. A proxy running as the same user, or any proxy on macOS or Windows, is still treated as local (GCVE-110-VULN-PYPI-2026-000643). The rate limit on the same server is GCVE-110-VULN-PYPI-2026-000615. Affects 0.1.0 through 0.1.3.