CVE-2023-26919 Security feature bypass in n/a
Attackers can bypass the Nashorn sandbox restrictions to execute arbitrary code and terminate the Java process when specific exit functions are disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26919?
CVE-2023-26919 is a high-severity vulnerability in n/a, published on 10 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
Weakness: CWE-74
Which versions are affected by CVE-2023-26919?
It affects 1 product.
Products include Javadelight Nashorn Sandbox.
How do I fix CVE-2023-26919?
No fix has been published for CVE-2023-26919 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-26919 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26919 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wfwf-xhx7-3whj.