CVE-2023-40023

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp1 are impacted. This vulnerability has been patched in version 1.2.4-sp1. Users are advised to upgrade. users unable to upgrade may avoid exposing vulnerable versions to untrusted input and to closely monitor any unexpected server behavior until they can upgrade.

• CWE-200

• https://github.com/yaklang/yaklang/pull/295Patch
• https://github.com/yaklang/yaklang/pull/296Patch
• https://github.com/yaklang/yaklang/security/advisories/GHSA-xvhg-w6qc-m3qqThird Party Advisory
• https://github.com/yaklang/yaklang/pull/295Patch
• https://github.com/yaklang/yaklang/pull/296Patch
• https://github.com/yaklang/yaklang/security/advisories/GHSA-xvhg-w6qc-m3qqThird Party Advisory

Published

Aug 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40018FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2023-40019FreeSWITCH is a Software Defined Telecom Stack enabling the …6.5
• CVE-2023-4002An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-40020PrivateUploader is an open source image hosting server writt…8.3
• CVE-2023-40021Oppia is an online learning platform. When comparing a recei…5.3
• CVE-2023-40022Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2023-40024ScanCode.io is a server to script and automate software comp…6.1
• CVE-2023-40025Argo CD is a declarative, GitOps continuous delivery tool fo…7.1
• CVE-2023-40026Argo CD is a declarative continuous deployment framework for…4.3
• CVE-2023-40027Keystone is an open source headless CMS for Node.js — built …5.3
• CVE-2023-40028Ghost is an open source content management system. Versions …6.5
• CVE-2023-40029Argo CD is a declarative continuous deployment for Kubernete…9.6