CVE-2026-25117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25117", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T14:03:42.539Z", "datePublished": "2026-01-29T21:53:57.243Z", "dateUpdated": "2026-02-02T16:34:41.953Z"}, "containers": {"cna": {"title": "pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg"}, {"name": "https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a", "tags": ["x_refsource_MISC"], "url": "https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a"}], "affected": [{"vendor": "pwncollege", "product": "dojo", "versions": [{"version": "< e33da14449a5abcff507e554f66e2141d6683b0a", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:53:57.243Z"}, "descriptions": [{"lang": "en", "value": "pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue."}], "source": {"advisory": "GHSA-wvcf-9xm8-7mrg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-30T14:42:43.008706Z", "id": "CVE-2026-25117", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:34:41.953Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25117", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-30T14:42:43.008706Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T14:42:46.311Z"}}], "cna": {"title": "pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution", "source": {"advisory": "GHSA-wvcf-9xm8-7mrg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pwncollege", "product": "dojo", "versions": [{"status": "affected", "version": "< e33da14449a5abcff507e554f66e2141d6683b0a"}]}], "references": [{"url": "https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg", "name": "https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a", "name": "https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:53:57.243Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25117", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:34:41.953Z", "dateReserved": "2026-01-29T14:03:42.539Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T21:53:57.243Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dojo", "vendor": "pwncollege", "versions": [{"status": "affected", "version": "< e33da14449a5abcff507e554f66e2141d6683b0a"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue."}, {"lang": "es", "value": "pwn.college DOJO es una plataforma educativa para aprender ciberseguridad. Antes del commit e33da14449a5abcff507e554f66e2141d6683b0a, la falta de sandboxing en las rutas `/workspace/*` permite a los autores de desaf\u00edos inyectar javascript arbitrario que se ejecuta en el mismo origen que 'http[:]//dojo[.]website'. Esto es un escape de sandbox que lleva a la ejecuci\u00f3n arbitraria de javascript como el origen del dojo. Un autor de desaf\u00edos puede crear una p\u00e1gina que ejecute cualquier acci\u00f3n peligrosa que el usuario podr\u00eda. La versi\u00f3n e33da14449a5abcff507e554f66e2141d6683b0a soluciona el problema."}], "id": "CVE-2026-25117", "lastModified": "2026-06-17T10:24:08.310", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25117", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-30T14:42:43.008706Z", "version": "2.0.3"}}]}, "published": "2026-01-29T22:15:56.270", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a"}, {"source": "security-advisories@github.com", "url": "https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:17:16.817675+00:00", "value": {"mitigation_remediation": ["Update the Dojo platform to commit e33da14449a5abcff507e554f66e2141d6683b0a or later", "Verify that sandboxing is enforced for all /workspace/* routes", "Restrict challenge author permissions to prevent injection of malicious content"], "summary": {"action": "Patch Now", "impact": "arbitrary JavaScript execution in the dojo's origin"}, "threat_synthesis": {"affected_systems": "All releases of pwncollege:dojo prior to commit e33da14449a5abcff507e554f66e2141d6683b0a are affected. The commit introduces proper sandboxing that mitigates the flaw.", "description_and_impact": "The vulnerability stems from missing sandboxing on the /workspace/* routes in the pwn.college Dojo platform. A challenge author can inject arbitrary JavaScript that executes with the same origin as dojo.website. This enables the execution of any actions the user can perform, potentially exposing sensitive data or modifying site state. The flaw falls under CWE\u201120 and CWE\u201179.", "risk_and_exploitability": "The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely limited to challenge authors who can craft malicious challenges; once a challenge is loaded, any user visiting the page may suffer arbitrary JavaScript execution. The exploit is straightforward once the malicious challenge is deployed, but requires the author role or permission to inject content into /workspace/*."}}}}, "created": "2026-01-30T08:42:32.818778+00:00", "updated": "2026-04-18T01:30:16.029303+00:00", "vendors": ["pwncollege", "pwncollege$PRODUCT$dojo"]}