PT-2026-24899 · Autohomecorp · Frostmourne

Ana10Gy + 1 · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-3968

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AutohomeCorp frostmourne version 1.0

Description A security issue exists in AutohomeCorp frostmourne that allows for code injection. This occurs due to manipulation of the EXPRESSION argument within the scriptEngine.eval function located in the ExpressionRule.java file of the Oracle Nashorn JavaScript Engine component. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed. The vendor was informed of this disclosure but did not respond.

Recommendations AutohomeCorp frostmourne version 1.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-3968

Affected Products

Frostmourne

References · 10

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/17 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3968 · Security Note
• https://t.me/CVEtracker/47207 · Telegram Post
• https://vuldb.com/?submit.768949 · Note
• https://twitter.com/fernandokarl/status/2031930473979543689 · Twitter Post
• https://vuldb.com/?id.350397 · Note
• https://twitter.com/CVEarity/status/2032076783978447317 · Twitter Post
• https://twitter.com/CVEnew/status/2031992354618708280 · Twitter Post
• https://t.me/cveNotify/155211 · Telegram Post
• https://vuldb.com/?ctiid.350397 · Note