What’s Vulnerable › Vulnerabilities

CVE-2026-25117: pwn.college DOJO vulnerable to sandbox escape leading to arbitrary javascript execution

• Severity: high (CVSS 8.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-29 · updated 2026-06-17
• Weakness: CWE-20

Description

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Affected products

• pwncollege dojo: before e33da14449a5abcff507e554f66e2141d6683b0a

References

• https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a
• https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg

Get alerted when CVE-2026-25117 or the next vulnerability affects your stack