CVE-2026-25117: Pwncollege Dojo

High severity, CVSS 8.3. EPSS: 0.6% chance of exploitation in the next 30 days.

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Affected products

• Pwncollege Dojo: before e33da14449a5abcff507e554f66e2141d6683b0a (fixed in e33da14449a5abcff507e554f66e2141d6683b0a)

Published 2026-01-29. Last modified 2026-06-17.