CVE-2026-65843: sync-rpc: Arbitrary remote code execution vulnerability
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sync-rpcto a version that resolves this vulnerability.Fixed in 1.3.7
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Deployments running sync-rpc before version 1.3.7 are exposed if the relevant port is reachable and not blocked by a firewall. An attacker must be able to guess the correct port.
Does exploitation require credentials or user interaction?
No credentials or user interaction are described as prerequisites. The issue can be exploited remotely when the port is accessible and the attacker guesses it correctly.
What can be done if upgrading is not immediately possible?
Block access to the sync-rpc port with a firewall so it is not reachable by attackers. Upgrade to version 1.3.7 when possible.
How can I determine whether a system is affected?
Check whether the application uses sync-rpc earlier than version 1.3.7 and whether its port is reachable without firewall protection. Affected systems may allow execution of arbitrary JavaScript files already stored on the server.