CVE-2023-26919

delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

EPSS

0.61% chance of exploitation in the next 30 days, 47th percentile

Published

2023-04-10

Updated

2025-02-11

Proof-of-concept exploits (1)

• javadelight/delight-nashorn-sandbox/issues/135

References

• CVE Record
• NVD entry

Related

• CVE-2021-40660
• CVE-2023-26918
• CVE-2023-2692
• CVE-2023-26913
• CVE-2023-26921
• CVE-2023-26912