Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-25117 Sandbox Escape in http://pwn.college DOJO via Arbitrary JavaScript Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25117
Post summary
This entry discloses a sandbox escape vulnerability (CVE-2026-25117) in pwn.college's DOJO due to arbitrary JavaScript injection, with no PoC, exploit, active exploitation, or patch information provided.
CVE-2026-25117 http://pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` r… https://www.cve.org/CVERecord?id=CVE-2026-25117
Post summary
The post discloses a sandboxing flaw in DOJO’s /workspace/* path, identified before a specific commit, but offers no PoC, exploit, or patch details.