Description
A vulnerability was found in web-arena-x webarena up to 0.2.0. It has been declared as critical. This vulnerability affects the function HTMLContentEvaluator of the file webarena/evaluation_harness/evaluators.py. The manipulation of the argument target["url"] leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| web-arena-x | webarena | 0.1, 0.2.0 | — |
References
- VDB-306376 | web-arena-x webarena evaluators.py HTMLContentEvaluator code injection vdb-entry technical-description
- VDB-306376 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #558415 | web-arena-x webarena <=0.2.0 Code Injection third-party-advisory
- https://github.com/web-arena-x/webarena/issues/194 issue-tracking
- https://github.com/web-arena-x/webarena/issues/194#issuecomment-2796165922 exploit issue-tracking