https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:45:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337125 EUVD-2026-337125 https://cve.radiocsirt.org/vuln/euvd-2026-337125 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23681 <p>Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.</p> <p>Artemis Java Test Sandbox versions before 1.11.2 are vulnerable to a sandbox escape when an attacker loads untrusted libraries using System.load or System.loadLibrary. An attacker can abuse this issue to execute arbitrary Java when a victim executes the supposedly sandboxed code.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23681 https://cve.radiocsirt.org/vuln/ghsa-98hq-4wmw-98w9 <p><strong>Affected:</strong> Maven: de.tum.in.ase:artemis-java-test-sandbox</p> <p>### Summary Because of the missing `checkLink(String)` override in the SecurityManager, students can load libraries and execute arbitrary code.</p> <p>### Details Using `System.load(String)` or `System.loadLibrary​(String)` students can load and execute arbitrary code.</p> <p>```java private static native void start(List&lt;String&gt; args);</p> <p>public static void main(String[] args) { System.load(new File(&#34;path_to_lib.so&#34;).getAbsolutePath()); start(List.of(args)); } ```</p> <p>Adding this to the security manager (and a translation) should fix the issue: ```java @Override public void checkExec(String cmd) { try { if (enterPublicInterface()) return; throw new SecurityException(localized(&#34;security.error_link&#34;)); //$NON-NLS-1$ } finally { exitPublicInterface(); } } ```</p> <p>### PoC See details.</p> <p>### Impact Arbitrary code execution.</p> <p><strong>Affected:</strong> Maven: de.tum.in.ase:artemis-java-test-sandbox</p> <p>### Summary Because of the missing `checkLink(String)` override in the SecurityManager, students can load libraries and execute arbitrary code.</p> <p>### Details Using `System.load(String)` or `System.loadLibrary​(String)` students can load and execute arbitrary code.</p> <p>```java private static native void start(List&lt;String&gt; args);</p> <p>public static void main(String[] args) { System.load(new File(&#34;path_to_lib.so&#34;).getAbsolutePath()); start(List.of(args)); } ```</p> <p>Adding this to the security manager (and a translation) should fix the issue: ```java @Override public void checkExec(String cmd) { try { if (enterPublicInterface()) return; throw new SecurityException(localized(&#34;security.error_link&#34;)); //$NON-NLS-1$ } finally { exitPublicInterface(); } } ```</p> <p>### PoC See details.</p> <p>### Impact Arbitrary code execution.</p> https://cve.radiocsirt.org/vuln/ghsa-98hq-4wmw-98w9 https://cve.radiocsirt.org/vuln/gsd-2024-23681 gsd-2024-23681 https://cve.radiocsirt.org/vuln/gsd-2024-23681