PT-2026-145435

CVE-2026-65843

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions sync-rpc versions prior to 1.3.7

Description The software executes asynchronous commands synchronously by utilizing a separate process. An attacker who can identify the correct port and bypass firewall restrictions can load and execute arbitrary JavaScript files residing on the server hosting the service.

Recommendations Update to version 1.3.7.

Exploitability

Exploit

Fix

Impacts

Researchers

Maddyguthridge

Vendors

Affected products

Weakness enumeration

CWE-306: Missing Authentication for Critical Function

Related identifiers