CVE-2026-3384
Last modified
CVE-2026-3384 is a low-severity vulnerability rated 1.9/10 on the CVSS scale. A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A security vulnerability has been detected in ChaiScript up to 6.1.0. This impacts the function chaiscript::eval::AST_Node_Impl::eval/chaiscript::eval::Function_Push_Pop of the file include/chaiscript/language/chaiscript_eval.hpp. The manipulation leads to uncontrolled recursion. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chaiscript | Chaiscript | <= 6.1.0 |
References
- https://github.com/ChaiScript/ChaiScript/issues/633Issue Tracking
- https://vuldb.com/?ctiid.348270Permissions Required, VDB Entry
- https://vuldb.com/?id.348270Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.761303Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-3384?
How severe is CVE-2026-3384?
How do I fix CVE-2026-3384?
Are you affected by CVE-2026-3384?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST