SB20260825120 - Protection mechanism failure in AviatorScript

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260825120

SB20260825120 - Protection mechanism failure in AviatorScript

Published: August 25, 2026

Security Bulletin ID SB20260825120
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Protection mechanism failure (CVE-ID: N/A)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass the sandbox and perform arbitrary file read, write, and delete operations.

The vulnerability exists due to protection mechanism failure in the enableSandboxMode() method when enabling sandbox mode after the built-in io module has been loaded and exposed to expression evaluation. A remote user can supply a crafted expression using io.slurp(), io.spit(), or io.delete() to bypass the sandbox and perform arbitrary file read, write, and delete operations.

Exploitation requires the application to inject the io module into the expression execution environment and allow attacker-controlled expressions to be evaluated.


Remediation

Install update from vendor's website.

References