ExploitGrid@exploitgrid
[EXPLOIT] CVE-2022-24803 [CRITICAL/PoC] CVSS: 10 | Vendor: #jirutka CVE-2022-24803 🔗 https://exploitgrid.net/exploits/f9d99aaf-d91d-45e9-96dd-23eced49c17e
1000037
438 followersView on X
CVE-2022-24803(asciidoctor-include-ext_project / asciidoctor-include-ext)
LOWCVSS 9.8 · CRITICALSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
0.0/ 10 priority
Sources & remediation
Patch / fix
- https://github.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c7033575342c51483dab7b87ae155
- https://github.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee
- https://github.com/jirutka/asciidoctor-include-ext/commit/c7ea001a597c7033575342c51483dab7b87ae155
- https://github.com/jirutka/asciidoctor-include-ext/commit/cbaccf3de533cbca224bf61d0b74e4b84d41d8ee
Exploit / PoC references
Vendor / third-party advisories
Weakness type (CWE)
CWE-78
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- asciidoctor-include-ext
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Affected systems
Products
asciidoctor-include-ext
Deep dive
Activity timeline2 mentions / 1d
Referenced assets1 URL
Full discourse2 posts
- ExploitGrid@exploitgrid
ExploitGrid Daily Digest 🚨 Top Exploits: CVE-2022-24803 (CVSS: 10) jirutka CVE-2024-13985 (CVSS: 10) Zhejiang Dah... CVE-2026-20131 (CVSS: 10) Cisco CVE-2026-75650 (CVSS: 10) Adobe CVE-2026-97229 (CVSS: 10) gitlab ..🧵👇
10000120438 followersView on X
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | asciidoctor-include-ext_project | asciidoctor-include-ext | - | - | - |