CVE-2026-25117

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25117

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25117.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25117

Aliases

GHSA-wvcf-9xm8-7mrg

Published

2026-01-29T21:53:57.243Z

Modified

2026-08-07T11:31:34.280132390Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVSS Calculator

Summary

pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

Details

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/* routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http[:]//dojo[.]website. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25117.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "e33da14449a5abcff507e554f66e2141d6683b0a"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/pwncollege/dojo

Affected ranges

Type

GIT

Repo

https://github.com/pwncollege/dojo

Events

Introduced

Fixed

e33da14449a5abcff507e554f66e2141d6683b0a

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25117.json"