PT-2026-22507 · Wren · Wren

Oneafter · Published 2026-03-01 · Updated 2026-03-10 · CVE-2026-3385

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions wren-lang wren versions up to 0.4.0

Description A flaw exists in the resolveLocal function within the src/vm/wren compiler.c file. This issue leads to uncontrolled recursion. Local access is required for exploitation. The details of the issue have been publicly disclosed.

Recommendations Versions prior to 0.4.0 should be updated. As a temporary workaround, consider restricting the use of the resolveLocal function until a patch is available.

Exploit

Fix

Uncontrolled Recursion

Improper Resource Release

Weakness Enumeration

CWE-674

CWE-404

Related Identifiers

CVE-2026-3385

Affected Products

Wren

References · 14

• 🔥 https://github.com/oneafter/0122/blob/main/i1218/repro · Exploit
• https://github.com/wren-lang/wren/issues/1218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3385 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3385 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2028031448989491616 · Twitter Post
• https://vuldb.com/?ctiid.348271 · Note
• https://vuldb.com/?id.348271 · Note
• https://twitter.com/CVEnew/status/2028031237462560873 · Twitter Post
• https://vuldb.com/?submit.761305 · Note
• https://twitter.com/dailycve/status/2031396662287958407 · Twitter Post
• https://t.me/cveNotify/154901 · Telegram Post
• https://github.com/wren-lang/wren · Note
• https://t.me/CVEtracker/46059 · Telegram Post
• https://t.me/cveNotify/153664 · Telegram Post