VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Mar 12, 2026· Updated Apr 29, 2026

CVE-2026-3968

CVE-2026-3968

Description

A vulnerability has been found in AutohomeCorp frostmourne up to 1.0. This affects the function scriptEngine.eval of the file ExpressionRule.java of the component Oracle Nashorn JavaScript Engine. Such manipulation of the argument EXPRESSION leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Frostmourne ≤1.0 has a code injection vulnerability in ExpressionRule.java via Nashorn eval, enabling RCE for authenticated admins.

Vulnerability

Description A code injection vulnerability exists in AutohomeCorp's Frostmourne up to version 1.0. The issue is in the ExpressionRule.java file, where the scriptEngine.eval function is called with the EXPRESSION argument without proper sanitization [1]. This allows arbitrary JavaScript code to be executed by the Oracle Nashorn script engine, which has full access to Java classes and system resources.

Exploitation

Prerequisites Exploitation requires administrative access to the alarm configuration interface. An attacker authenticated as an admin can send a malicious POST request to the /save endpoint with crafted JavaScript in the EXPRESSION field [1]. The expression is stored in the database and later executed during alarm evaluation, leading to server compromise.

Impact

Successful exploitation results in remote code execution with the privileges of the application server. Attackers can execute system commands, read/write files, or establish reverse shells, potentially leading to full server takeover [1].

Mitigation

Status The vendor was contacted but did not respond, and no patch is available. As a workaround, restrict access to the admin interface to trusted users and consider disabling the Nashorn JavaScript engine if feasible [1].

References
  1. Remote Code Execution via Nashorn Script Engine in Frostmourne

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.