JoySafeter EUVD-2026-104683

Exploitation requires an authenticated low-privilege account (PR:L), but the barrier is minimal because the application permits self-registration; the attacker must then use the WebSocket chat.start extension, select Copilot 'standard mode', and trigger the execute tool, which runs subprocess.run with shell=True without sandboxing. Concrete prerequisites: open/self-service registration enabled, standard mode available to the account, and network reachability to the WebSocket endpoint. Limiting factors are the need for a valid (self-created) session and a reachable instance; no user interaction from a victim and no high privileges are required, so default internet-facing deployments with open registration are directly exposed.

This is a credible operational priority, not a paper tiger. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7 High) and the description agree: a network-reachable, low-complexity attack requiring only low privileges and no user interaction yields full confidentiality, integrity, and availability impact via host operating-system command execution. The low-privilege requirement (PR:L) is effectively trivial because the description states attackers can self-register, so the authentication barrier offers little real defense where open registration is enabled. Publicly available exploit code exists (per VulnCheck/Lasso references), which raises near-term risk, but this is NOT the same as active exploitation: there is no CISA KEV listing and no EPSS score was provided, so exploitation probability cannot be quantified from the input. CWE-653 (improper isolation/compartmentalization) is consistent with the reported cross-tenant data and server-secret exposure. The one tempering factor is deployment footprint: this is an obscure JD open-source project (jd-opensource/joysafeter) at version 1.0.0, so despite the high severity and available POC, real-world blast radius is limited by low prevalence. Signals are internally consistent - no contradictions between vector and description - the main missing data are EPSS and any vendor-confirmed patched version.

An attacker self-registers a standard user account on an internet-facing JoySafeter instance, opens a WebSocket chat.start session, and selects Copilot 'standard mode'. They then prompt the agent to use its unsandboxed execute tool, causing the backend to call subprocess.run with shell=True and run arbitrary OS commands on the host to read other tenants' data and server secrets. A public exploit/POC is referenced, lowering the skill needed; the low attack complexity (AC:L) and no required user interaction make this straightforward once an account exists.