CVE-2026-2240

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-2240

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2240.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-2240

Published

2026-02-09T15:32:10Z

Modified

2026-10-28T11:09:46Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

janet-lang janet compile.c janetc_pop_funcdef out-of-bounds

Details

A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5. A patch should be applied to remediate this issue.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2240.json"
}

References

Affected packages

Git / github.com/janet-lang/janet

Affected ranges

Type

GIT

Repo

https://github.com/janet-lang/janet

Events

Introduced

7e0c692d4e69383c26088f70a50bf793ed0d735b

Fixed

4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.40.0"
                },
                {
                    "last_affected":  "1.40.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "1.40.1"
                },
                {
                    "last_affected":  "1.40.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.40.0

1.40.1

v1.*

v1.40.0

v1.40.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2240.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "214190959972194526235716830265561870328",
            "length":  1116
        },
        "id":  "CVE-2026-2240-018d563a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/core/io.c",
            "function":  "janet_dynprintf"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "32326709762157823266090130667596064746",
            "length":  3765
        },
        "id":  "CVE-2026-2240-1949eac5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/core/compile.c",
            "function":  "janetc_pop_funcdef"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "129974172248156411833689488678535627705",
            "length":  343
        },
        "id":  "CVE-2026-2240-2ea0244e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/mainclient/shell.c",
            "function":  "savehistory"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "101787241100834466017908988923848359954",
                "242226077026452114764669332311655084445",
                "24257182039059199003417950454958484776",
                "185063801959956441004938115134755199383"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2240-2fd86e35",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/core/io.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "329320749035855979406612586541100938939",
                "330133427121041722600053945692365024221",
                "41715594008354400220783834437480755309",
                "67983710413322016106816538753725412786",
                "98048863920160825096524601563683997678"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2240-6ce8f497",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/core/compile.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292535847021121797384379015677985504527",
                "152945569975190055018400356135222682900",
                "35338272386683302072103242016952696209",
                "66644456928388379379016150498362920016"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2240-a8ab9ed6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5",
        "target":  {
            "file":  "src/mainclient/shell.c"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:09:46Z"