Vulnerability Description
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
Related Weaknesses (CWE)
References
- https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b
- https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg
FAQ
What is CVE-2026-25117?
CVE-2026-25117 is a documented vulnerability. pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to ...
How severe is CVE-2026-25117?
CVSS scoring is not yet available for CVE-2026-25117. Check NVD for updates.
Is there a patch for CVE-2026-25117?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.