CVE-2026-25117 | BDVDB-2026-313012 Detail

Description#

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-01-29Record published in the CVE List.
2. Version 22026-02-02Most recent update recorded in the CVE List.