VYPR
← All advisories
High severityOSV Advisory· Published Jan 29, 2026· Updated Apr 15, 2026

CVE-2026-25117

CVE-2026-25117

Description

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/* routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http[:]//dojo[.]website. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Pwncollege/DojoOSV2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: < e33da14449a5abcff507e554f66e2141d6683b0a

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.