Judge0 vulnerabilities
We track 3 vulnerabilities in Judge0 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 18, 2024.
Latest Judge0 vulnerabilities
- 9.0 Critical severity
judge0: Server-Side Request Forgery
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsa
- 10.0 Critical severity
judge0: Improper Link Resolution Before File Access
Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to
- 10.0 Critical severity
judge0: Improper Link Resolution Before File Access
Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox. When exe