{"schema":"threatline.record/2","record":{"id":"CVE-2026-109443","aliases":[],"summary":"JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell","details":"JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.","categories":["Unclassified"],"product":"JoySafeter","vendor":"jd-opensource","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109443","source_modified_at":"2026-10-22T21:04:54.787Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"JoySafeter","vendor":"jd-opensource","versions":[{"version":"0","lessThanOrEqual":"1.0.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00705,"percentile":0.52814,"score_date":"2026-10-23"},"published_at":"2026-10-20T00:46:07.343Z","modified_at":"2026-10-22T21:04:54.787Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109443","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-22T21:04:54.787Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109443","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.lasso.security/vulnerability-database/cve-2026-109443","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/jd-opensource/JoySafeter/blob/12234a11a9d96acef85577afb1fa5682169d6171/backend/app/core/agent/backends/utils/command_executor.py#L110","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/jd-opensource/JoySafeter/blob/12234a11a9d96acef85577afb1fa5682169d6171/backend/app/services/copilot_service.py#L106","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/joysafeter-through-1.0.0-authenticated-rce-via-copilot-standard-mode-shell","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-20T13:50:07.322873Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-22T21:04:54.787Z","content_hash":"a829b1ae842e7aaf39d281e9da3bb60bab7826cf402c221f942673107a39cdf3"}}