CVE-2026-25117

N/A

Description

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

CVE Details

CVSS v3.1 ScoreN/A

Published1/29/2026

Last Modified2/4/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-20CWE-79

References

https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a(security-advisories@github.com)

https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.