CVE-2026-5752

CriticalCVSS 9.3/10Last modified Jul 24, 2026

Description

Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Coherecohere-terrarium1.0.1

References

Timeline

Published
Apr 14, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-575207.1Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permiCVE-2026-575214.3Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organCVE-2026-575225.0Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes CVE-2026-575278.8Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who controCVE-2026-57536.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and includingCVE-2026-575305.4Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packCVE-2026-575315.4Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated aCVE-2026-575328.8Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in CVE-2026-575332.1Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a CoCVE-2026-575342.1Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-575352.1Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status
CVE-2026-5752: Critical severity, CVSS 9.3 | Vulnix