High severity · published Apr 10, 2023
CVE-2023-26919
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NS
Nashorn Sandbox · Javadelight
0.2.4; 0.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26919
Exploit
https://github.com/javadelight/delight-nashorn-sandbox/issues/135
More from Nashorn Sandbox
7.5
CVE-2021-40660
An issue was discovered in Delight Nashorn Sandbox 0.2.0