CVE-2026-25117 pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution
Challenge authors can inject arbitrary JavaScript via missing sandboxing, enabling code execution and account takeover on the pwn.college DOJO platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-25117?
CVE-2026-25117 is a high-severity cross-site scripting vulnerability in pwncollege dojo, published on 29 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
Which versions are affected by CVE-2026-25117?
How do I fix CVE-2026-25117?
No fix has been published for CVE-2026-25117 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-25117 being exploited?
There is no known exploitation of CVE-2026-25117 in the wild and no public exploit code.
Sources
Also known as GHSA-wvcf-9xm8-7mrg.