Description
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
Published: 2026-11-11
Score: 8.7 High
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Description sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
Title sync-rpc: Arbitrary remote code execution vulnerability
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-11T18:29:55.356Z

Reserved: 2026-07-22T23:16:47.753Z

Link: CVE-2026-65843

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-11T19:17:44.120

Modified: 2026-11-11T19:17:44.120

Link: CVE-2026-65843

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses