CVE-2026-25117

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on "/workspace/" routes allows challenge authors to inject arbitrary javascript which runs on the same origin as "http://dojo.website". This is a...