A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. (CVE-2026-19360)
CVE-2026-19360 is a medium severity vulnerability in wongcyrus ExcelLexBot up to version 0.0.3 affecting the Lambda Function Handler component ExcelLexBotS3TriggerFunction. It involves improper privilege management that can be exploited remotely. The product is no longer supported by the maintainer, and no vendor response or patch is available.
AI Analysis
Technical Summary
This vulnerability affects wongcyrus ExcelLexBot versions up to 0.0.3 in the Lambda Function Handler component, specifically the ExcelLexBotS3TriggerFunction. The flaw is improper privilege management (CWE-266), which can be triggered remotely. The vendor was contacted but did not respond, and the product is no longer maintained. No patch or remediation is available, and no known exploits are reported in the wild. The CVSS v3.1 base score is 4.7 (medium severity) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
Potential Impact
The vulnerability allows an attacker with high privileges to remotely manipulate the Lambda function handler, potentially leading to limited confidentiality, integrity, and availability impacts. Since the product is unsupported, no official fixes or mitigations are provided, increasing risk for users still running affected versions.
Mitigation Recommendations
No official patch or remediation is available as the product is no longer supported and the vendor did not respond to disclosure. Users are advised to discontinue use of the affected product or implement compensating controls to restrict access to the vulnerable Lambda function. Monitor for any updates from the vendor or community.
A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. (CVE-2026-19360)
Description
CVE-2026-19360 is a medium severity vulnerability in wongcyrus ExcelLexBot up to version 0.0.3 affecting the Lambda Function Handler component ExcelLexBotS3TriggerFunction. It involves improper privilege management that can be exploited remotely. The product is no longer supported by the maintainer, and no vendor response or patch is available.
CVSS v3.1
Score 4.7medium
Affected software
pkg:github/wongcyrus/ExcelLexBotRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects wongcyrus ExcelLexBot versions up to 0.0.3 in the Lambda Function Handler component, specifically the ExcelLexBotS3TriggerFunction. The flaw is improper privilege management (CWE-266), which can be triggered remotely. The vendor was contacted but did not respond, and the product is no longer maintained. No patch or remediation is available, and no known exploits are reported in the wild. The CVSS v3.1 base score is 4.7 (medium severity) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L.
Potential Impact
The vulnerability allows an attacker with high privileges to remotely manipulate the Lambda function handler, potentially leading to limited confidentiality, integrity, and availability impacts. Since the product is unsupported, no official fixes or mitigations are provided, increasing risk for users still running affected versions.
Mitigation Recommendations
No official patch or remediation is available as the product is no longer supported and the vendor did not respond to disclosure. Users are advised to discontinue use of the affected product or implement compensating controls to restrict access to the vulnerable Lambda function. Monitor for any updates from the vendor or community.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-g6p6-cjcx-6p6p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19360"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a79f0f7bf8831d539f64b23
Added to database: 08/10/2026, 15:40:39 UTC
Last enriched: 08/10/2026, 16:13:50 UTC
Last updated: 08/10/2026, 17:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.