CVE-2026-2259

A vulnerability has been found in aardappel lobster up to 2025.4. Affected by this issue is the function lobster::Parser::ParseStatements in the library dev/src/lobster/parser.h of the component Parsing. The manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The identifier of the patch is 2f45fe860d00990e79e13250251c1dde633f1f89. Applying a patch is the recommended action to fix this issue.

• CWE-119
• CWE-787

• https://github.com/aardappel/lobster/Product
• https://github.com/aardappel/lobster/commit/2f45fe860d00990e79e13250251c1dde633f1f89Patch
• https://github.com/aardappel/lobster/issues/396Issue Tracking, Patch, Vendor Advisory
• https://github.com/aardappel/lobster/issues/396#issuecomment-3849019040Issue Tracking, Patch, Vendor Advisory
• https://github.com/oneafter/0204/blob/main/lob2/repro.lobsterExploit
• https://vuldb.com/?ctiid.345006Permissions Required, VDB Entry
• https://vuldb.com/?id.345006Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.753168Exploit, Third Party Advisory, VDB Entry

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22584Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2026-22585Use of a Broken or Risky Cryptographic Algorithm vulnerabili…9.8
• CVE-2026-22586Hard-coded Cryptographic Key vulnerability in Salesforce Mar…9.8
• CVE-2026-22587Ideagen DevonWay contains a stored cross site scripting vuln…5.5
• CVE-2026-22588Spree is an open source e-commerce solution built with Ruby …6.5
• CVE-2026-22589Spree is an open source e-commerce solution built with Ruby …7.5
• CVE-2026-22592Gogs is an open source self-hosted Git service. In version 0…6.5
• CVE-2026-22593EVerest is an EV charging software stack. Prior to version 2…7.8
• CVE-2026-22594Ghost is a Node.js content management system. In versions 5.…8.1
• CVE-2026-22595Ghost is a Node.js content management system. In versions 5.…8.1
• CVE-2026-22596Ghost is a Node.js content management system. In versions 5.…7.2
• CVE-2026-22597Ghost is a Node.js content management system. In versions 5.…2.7