Vulnerability · Published Jan 29, 2026 · Assigned by GitHub_M

CVE-2026-25117pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

High 8.3

In plain English

A high-severity improper input validation in dojo from pwncollege. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Affected products (as reported)

Vendor	Product	Versions
pwncollege	dojo	< e33da14449a5abcff507e554f66e2141d6683b0a

Weakness: CWE-20, CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

References

https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg x_refsource_CONFIRM
https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a x_refsource_MISC