CVE-2024-28189

Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. An attacker can abuse this by creating a symbolic link (symlink) to a file outside the sandbox, allowing the attacker to run chown on arbitrary files outside of the sandbox. This vulnerability is not impactful on it's own, but it can be used to bypass the patch for CVE-2024-28185 and obtain a complete sandbox escape. This vulnerability is fixed in 1.13.1.

• CWE-59
• CWE-61

• https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232
• https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd
• https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg
• https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf
• https://github.com/judge0/judge0/blob/v1.13.0/app/jobs/isolate_job.rb#L232
• https://github.com/judge0/judge0/commit/f3b8547b3b67863e4ea0ded3adcb963add56addd
• https://github.com/judge0/judge0/security/advisories/GHSA-3xpw-36v7-2cmg
• https://github.com/judge0/judge0/security/advisories/GHSA-h9g2-45c8-89cf

Published

Apr 18, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28183ESP-IDF is the development framework for Espressif SoCs supp…5.7
• CVE-2024-28184WeasyPrint helps web developers to create PDF documents. Sin…7.4
• CVE-2024-28185Judge0 is an open-source online code execution system. The a…10
• CVE-2024-28186FreeScout is an open source help desk and shared inbox built…7.1
• CVE-2024-28187SOY CMS is an open source CMS (content management system) th…7.2
• CVE-2024-28188Jupyter Scheduler is collection of extensions for programmin…5.3
• CVE-2024-2819Incorrect Default Permissions, Improper Preservation of Perm…6.5
• CVE-2024-28190Contao is an open source content management system. Starting…5.4
• CVE-2024-28191Contao is an open source content management system. Starting…5.4
• CVE-2024-28192your_spotify is an open source, self hosted Spotify tracking…5.3
• CVE-2024-28193your_spotify is an open source, self hosted Spotify tracking…6.5
• CVE-2024-28194your_spotify is an open source, self hosted Spotify tracking…9.8