PT-2026-7120 · Unknown · Janet-Lang

Oneafter · Published 2026-02-09 · Updated 2026-02-25 · CVE-2026-2240

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions janet-lang janet versions prior to 1.40.1

Description A flaw exists in the janet-lang programming language compiler, specifically within the janetc pop funcdef function located in the src/core/compile.c file. This issue allows for an out-of-bounds read when triggered locally. The exploit for this issue has been publicly disclosed.

Recommendations Apply the patch with identifier 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5 to remediate this issue.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2026-2240

Affected Products

Janet-Lang

References · 13

• 🔥 https://github.com/janet-lang/janet/issues/1702#issuecomment-3790473369 · Exploit
• 🔥 https://github.com/janet-lang/janet/issues/1702 · Exploit
• 🔥 https://github.com/oneafter/0123/blob/main/ja4/repro · Exploit
• https://github.com/janet-lang/janet/commit/4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5 · Patch
• https://osv.dev/vulnerability/CVE-2026-2240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2240 · Security Note
• https://twitter.com/VulmonFeeds/status/2020925021347090610 · Twitter Post
• https://t.me/cveNotify/153158 · Telegram Post
• https://vuldb.com/?id.344979 · Note
• https://vuldb.com/?ctiid.344979 · Note
• https://vuldb.com/?submit.753155 · Note
• https://t.me/CVEtracker/44220 · Telegram Post
• https://github.com/janet-lang/janet · Note