{"affected":[{"product":"sync-rpc","source":"CNA: GitHub_M","vendor":"ForbesLindesay","versions":[{"status":"affected","version":"< 1.3.7"}]}],"cveId":"CVE-2026-65843","cwes":["CWE-306"],"description":"sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794421795356,"publishedAt":1794421795356,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07"}],"remediation":[],"revision":"e775cc29651c9cc04b0142a7b3447a6d5ccf9b76619c96d9c6bed6aa4bc4c0be","sources":[{"modifiedAt":1794421795356,"name":"CNA: GitHub_M","retrievedAt":1794424163286,"url":"https://www.cve.org/CVERecord?id=CVE-2026-65843"}],"ssvc":null,"status":"published","title":"sync-rpc: Arbitrary remote code execution vulnerability","updatedAt":1794424163286}