Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-121881

Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated session; no administrative privileges are needed. The vulnerability is limited to disclosure of database contents.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Posit Posit Software
Products
Workbench Posit Workbench
CVE-2026-121880

RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session. NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.

CVSS 4.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Posit Posit Software, Pbc
Products
Rstudio Server Workbench Posit Workbench and 1 more