PT-2026-7121 · Unknown · Janet-Lang

Oneafter · Published 2026-02-09 · Updated 2026-02-25 · CVE-2026-2241

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions janet-lang versions prior to 1.40.1

Description A flaw exists in the os strftime function within the src/core/os.c file of janet-lang. A manipulation of this function can lead to an out-of-bounds read. This issue requires local access to initiate the attack. The exploit is publicly available.

Recommendations Deploy the patch 0f285855f0e34f9183956be5f16e045f54626bff.

Exploit

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2026-2241

Affected Products

Janet-Lang

References · 13

• 🔥 https://github.com/janet-lang/janet/issues/1701 · Exploit
• 🔥 https://github.com/janet-lang/janet/issues/1701#event-4446770461 · Exploit
• 🔥 https://github.com/oneafter/0123/blob/main/ja3/repro · Exploit
• https://github.com/janet-lang/janet/commit/0f285855f0e34f9183956be5f16e045f54626bff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-2241 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2241 · Vendor Advisory
• https://vuldb.com/?ctiid.344980 · Note
• https://t.me/cveNotify/153159 · Telegram Post
• https://vuldb.com/?id.344980 · Note
• https://t.me/CVEtracker/44224 · Telegram Post
• https://vuldb.com/?submit.753156 · Note
• https://twitter.com/VulmonFeeds/status/2020950624674762795 · Twitter Post
• https://github.com/janet-lang/janet · Note