PT-2026-5368 · Dojo · Dojo

Supercoolspy · CVE-2026-25117 · Published 2026-01-29 · Updated 2026-01-30

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions pwn.college DOJO versions prior to commit e33da14449a5abcff507e554f66e2141d6683b0a

Description A missing sandbox implementation on routes starting with /workspace/* allows challenge authors to inject arbitrary JavaScript code. This code executes within the same origin as http[:]//dojo[.]website, resulting in a sandbox escape and arbitrary JavaScript execution with the privileges of the DOJO origin. An attacker, specifically a challenge author, can create a malicious page that performs dangerous actions on behalf of a user. The affected API endpoint is /workspace/*. The vulnerable component is the sandboxing mechanism for routes starting with /workspace/*.

Recommendations Update to commit e33da14449a5abcff507e554f66e2141d6683b0a or a later version to address the missing sandboxing issue.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2026-25117

GHSA-WVCF-9XM8-7MRG

Affected Products

Dojo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25117.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25117 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25117 · Vendor Advisory
• https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a · Note
• https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg · Note
• https://twitter.com/CVEnew/status/2017000649305559205 · Twitter Post
• https://t.me/CVEtracker/43259 · Telegram Post