CVE-2026-10267

A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Performing a manipulation results in out-of-bounds read. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The patch is named ed17dd2c5913a23fb1107251e44a9410a3c30cf5.

• CWE-119
• CWE-125

• https://github.com/biniamf/pocs/tree/main/janet-debug-janet-doframe-env-data-oobread
• https://github.com/janet-lang/janet/
• https://github.com/janet-lang/janet/commit/ed17dd2c5913a23fb1107251e44a9410a3c30cf5
• https://github.com/janet-lang/janet/issues/1743
• https://github.com/janet-lang/janet/issues/1743#issuecomment-4322129448
• https://vuldb.com/cve/CVE-2026-10267
• https://vuldb.com/submit/825072
• https://vuldb.com/vuln/367546
• https://vuldb.com/vuln/367546/cti

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102663OpenList is a file list program that supports multiple stora…4.3
• CVE-2026-102664ProxySQL is a proxy for MySQL and its forks, as well as Post…7.1
• CVE-2026-102666The Joyland AI app contains hard-coded credentials for the G…6.5
• CVE-2026-102667Joyland AI app allows an attacker with shared network access…8.3
• CVE-2026-102668The Joyland AI app accepts any TLS certificates from any ser…5.3
• CVE-2026-102669Joyland AI app does not verify hostnames, allowing a malicio…5.3
• CVE-2026-102670Joyland AI app explicitly permits cleartext HTTP traffic on …4.3
• CVE-2026-102671The Joyland AI app accepts invalid SSL certificates in the i…5.3
• CVE-2026-102672Electron is a framework for writing cross-platform desktop a…6.7
• CVE-2026-102673Electron is a framework for writing cross-platform desktop a…6.1
• CVE-2026-102674Electron is a framework for writing cross-platform desktop a…6.1
• CVE-2026-102675Electron is a framework for writing cross-platform desktop a…7.4