CVE-2026-25117: pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on /workspace/ routes allows challenge authors to inject arbitrary javascript which runs on the same origin as http[:]//dojo[.]website. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25117?
The severity of CVE-2026-25117 is high due to its potential for arbitrary JavaScript execution.
How do I fix CVE-2026-25117?
To fix CVE-2026-25117, update pwn.college DOJO to a version after commit e33da14449a5abcff507e554f66e2141d6683b0a.
What kind of attacks can CVE-2026-25117 enable?
CVE-2026-25117 can enable attacks that result in sandbox escape and arbitrary JavaScript execution.
Is CVE-2026-25117 present in all versions of pwn.college DOJO?
CVE-2026-25117 affects all versions of pwn.college DOJO prior to commit e33da14449a5abcff507e554f66e2141d6683b0a.
Who is impacted by CVE-2026-25117?
Challenge authors and users of the vulnerable versions of pwn.college DOJO are impacted by CVE-2026-25117.