CVE-2026-3392

A weakness has been identified in FascinatedBox lily up to 2.3. The affected element is the function eval_tree of the file src/lily_emitter.c. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-404
• CWE-476

• https://github.com/FascinatedBox/lily/Product
• https://github.com/FascinatedBox/lily/issues/384Exploit, Issue Tracking, Vendor Advisory
• https://github.com/oneafter/0122/blob/main/i384/repro.lilyExploit
• https://vuldb.com/?ctiid.348278Permissions Required, VDB Entry
• https://vuldb.com/?id.348278Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.761328Third Party Advisory, VDB Entry

Published

Mar 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33913OpenEMR is a free and open source electronic health records …4.9
• CVE-2026-33914OpenEMR is a free and open source electronic health records …7.2
• CVE-2026-33915OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-33916Handlebars provides the power necessary to let users build s…4.7
• CVE-2026-33917OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-33918OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-33921The Windows installer deployed Npcap leaving its access rest…5.2
• CVE-2026-33922A path traversal vulnerability was discovered in the Offline…6.8
• CVE-2026-33929Improper Limitation of a Pathname to a Restricted Directory …4.3
• CVE-2026-3393A security vulnerability has been detected in jarikomppa sol…7.8
• CVE-2026-33930Apache Traffic Server copies the client Host header into a f…8.2
• CVE-2026-33931OpenEMR is a free and open source electronic health records …6.5