CVE-2026-25117
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
- Affected products
- Dojo
- Fix
- Available
- CVSS 4.0
- 8.3 HIGH
- EPSS
- 0.6% (43th percentile)
- Weakness
- CWE-20, CWE-79
- NVD status
- Deferred
- Published
- 2026-01-29
No indexed exploits for CVE-2026-25117 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-25117 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.