CVE-2024-29021

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsandboxed code execution as root on the target machine. This vulnerability is fixed in 1.13.1.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918 CWE-1393

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-290228.8Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versio CVE-2024-290237.2Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are CVE-2024-290245.3JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Inse CVE-2024-290255.3Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2024-290269.1Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. In versions 0.1.2 and prior, a leni CVE-2024-290279.0Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-al CVE-2024-290285.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows CVE-2024-290296.1memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows una CVE-2024-29038.8A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function GetParentControlInfo of the CVE-2024-290305.3memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows au CVE-2024-290317.5Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. CVE-2024-290327.8Qiskit IBM Runtime is an environment that streamlines quantum computations and provides optimal implementations of the Qiskit quantum comput