CVE-2024-28189
Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 7.21%
- CWE
- CWE-61, CWE-59
- Published
- 2024-04-18
- Last modified
- 2026-03-13
Affected products
- judge0 judge0
Weakness type
Related vulnerabilities
- CVE-2026-57825 — In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed...
- CVE-2026-79939 — Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink)...
- CVE-2026-75038 — Predictable temporary file in /tmp allows symlink attack in LACT
- CVE-2026-55168 — Runtipi: Authenticated arbitrary file write via backup restore symlink planting
- CVE-2026-63125 — Incus vulnerable to root RCE via image backup.yaml symlink
- CVE-2026-64846 — Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
- CVE-2026-32657 — Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell...
- CVE-2026-47766 — crun follows rootfs /dev symlink while creating default devices