CVE-2026-35482

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35482", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T20:49:44.454Z", "datePublished": "2026-06-02T22:50:40.435Z", "dateUpdated": "2026-06-03T14:08:53.231Z"}, "containers": {"cna": {"title": "alf.io has an Authenticated RCE via Extension Script Sandbox Escape", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h"}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"version": "< 2.0-M5-2606", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T22:50:40.435Z"}, "descriptions": [{"lang": "en", "value": "alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue."}], "source": {"advisory": "GHSA-3w8f-mcf6-cm7h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T14:08:23.718093Z", "id": "CVE-2026-35482", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:08:53.231Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35482", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T14:08:23.718093Z"}}}], "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T14:08:42.265Z"}}], "cna": {"title": "alf.io has an Authenticated RCE via Extension Script Sandbox Escape", "source": {"advisory": "GHSA-3w8f-mcf6-cm7h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "alfio-event", "product": "alf.io", "versions": [{"status": "affected", "version": "< 2.0-M5-2606"}]}], "references": [{"url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h", "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-02T22:50:40.435Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35482", "state": "PUBLISHED", "dateUpdated": "2026-06-03T14:08:53.231Z", "dateReserved": "2026-04-02T20:49:44.454Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-02T22:50:40.435Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "alf.io", "vendor": "alfio-event", "versions": [{"status": "affected", "version": "< 2.0-M5-2606"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:*", "matchCriteriaId": "94A99417-2597-434A-B162-46312D997281", "versionEndExcluding": "2.0-M5-2606", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue."}, {"lang": "es", "value": "alf.io es un sistema de reserva de entradas de c\u00f3digo abierto para conferencias, ferias comerciales, talleres y encuentros. Antes de la versi\u00f3n 2.0-M5-2606, una vulnerabilidad de escape de sandbox en el motor de scripts de la extensi\u00f3n de alf.io permite a un administrador autenticado ejecutar comandos arbitrarios del sistema operativo en el servidor. El sistema de extensi\u00f3n est\u00e1 dise\u00f1ado para ejecutar JavaScript restringido en un entorno Rhino en sandbox; sin embargo, una combinaci\u00f3n de un objeto Java inyectado sin protecci\u00f3n ('returnClass') y una lista de bloqueo AST incompleta permite que el sandbox sea completamente evadido utilizando la reflexi\u00f3n de Java sin activar ning\u00fan error de validaci\u00f3n. La versi\u00f3n 2.0-M5-2606 corrige el problema."}], "id": "CVE-2026-35482", "lastModified": "2026-08-12T18:02:06.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35482", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T14:08:23.718093Z", "version": "2.0.3"}}]}, "published": "2026-06-02T23:16:37.473", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0-M5-2606)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "alf.io", "source": "cna", "vendor": "alfio-event"}, "product": "alf.io", "vendor": "alfio-event"}], "created": "2026-06-03T04:15:24.751460+00:00", "updated": "2026-06-03T10:54:23.046478+00:00", "vendors": ["alfio-event", "alfio-event$PRODUCT$alf.io"]}