CVE-2026-109443

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

CVE-2026-109443 JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

CVE-2026-109443 JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

EUVD-2026-104683

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

CVE-2026-109443 JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

CVE-2026-109443

JoySafeter versions up to and including 1.0.0 are vulnerable to a remote code execution (RCE) flaw. The issue stems from an unsandboxed execute tool within Copilot standard mode , where the agent can be manipulated to invoke subprocess.run with shell=True on the host system. Authenticated attacke...

PT-2026-117938

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the...

JD JoySafeter: Vulnerabilities in permission management and access control mechanisms

JD JoySafeter versions 1.0.0 and earlier have vulnerabilities related to permission licensing and access control. These vulnerabilities arise from the execute tool in Copilot’s standard mode not implementing sandbox isolation. After authenticated users select the standard mode in the WebSocket...