This is just one of many vulnerabilities in Geth and other Ethereum clients due to unauthenticated JSON-RPC on localhost. You might recall this even hit Redis y

This is just one of many vulnerabilities in Geth and other Ethereum clients due to unauthenticated JSON-RPC on localhost. You might recall this even hit Redis years ago. There are many simple solutions (force auth, xsrf token) and it is mind-boggling that these mitigations are not considered standard-issue in the space.