CVE-2023-43801

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can delete arbitrary files or folders belonging to the user that runs the Arduino Create Agent via a crafted HTTP DELETE request. This issue has been addressed in version `1.3.3`. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-22
• CWE-22

• https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
• https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppqVendor Advisory
• https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide
• https://github.com/arduino/arduino-create-agent/releases/tag/1.3.3
• https://github.com/arduino/arduino-create-agent/security/advisories/GHSA-mjq6-pv9c-qppqVendor Advisory
• https://www.nozominetworks.com/blog/security-flaws-affect-a-component-of-the-arduino-create-cloud-ide

Published

Oct 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43796Synapse is an open-source Matrix homeserver Prior to version…5.3
• CVE-2023-43797BigBlueButton is an open-source virtual classroom. Prior to …5.4
• CVE-2023-43798BigBlueButton is an open-source virtual classroom. BigBlueBu…5.4
• CVE-2023-43799Altair is a GraphQL Client. Prior to version 5.2.5, the Alta…7.8
• CVE-2023-4380A logic flaw exists in Ansible Automation platform. Whenever…6.3
• CVE-2023-43800Arduino Create Agent is a package to help manage Arduino dev…7.8
• CVE-2023-43802Arduino Create Agent is a package to help manage Arduino dev…7.8
• CVE-2023-43803Arduino Create Agent is a package to help manage Arduino dev…7.1
• CVE-2023-43804urllib3 is a user-friendly HTTP client library for Python. u…8.1
• CVE-2023-43805Nexkey is a fork of Misskey, an open source, decentralized s…7.5
• CVE-2023-43809Soft Serve is a self-hostable Git server for the command lin…7.5
• CVE-2023-4381Unverified Password Change in GitHub repository instantsoft/…4.3