GCVE - cpe:2.3:a:jd-opensource:joysafeter:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:jd-opensource:joysafeter:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Jd Opensource (`b9fd26e3-0885-5ee0-b0f7-403906aaaaae`)
Product	Joysafeter (`66d367f1-860c-53ea-9df5-33242879c5fe`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-109443`	vulnerable	2026-11-03 10:17:39.576992	JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell HIGH (8.8) JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets. Published: 2026-10-20T00:46:07.343Z Updated: 2026-10-22T21:04:54.787Z Open on db.gcve.eu Reference links https://www.lasso.security/vulnerability-database/cve-2026-109443 https://github.com/jd-opensource/JoySafeter/blob/12234a11a9d96acef85577afb1fa5682169d6171/backend/app/core/agent/backends/utils/command_executor.py#L110 https://github.com/jd-opensource/JoySafeter/blob/12234a11a9d96acef85577afb1fa5682169d6171/backend/app/services/copilot_service.py#L106 https://www.vulncheck.com/advisories/joysafeter-through-1.0.0-authenticated-rce-via-copilot-standard-mode-shell	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.