CVE-2026-109443: Improper Isolation or Compartmentalization in jd-opensource JoySafeter
Description
JoySafeter versions up to 1.0.0 have a remote code execution vulnerability that allows authenticated users to execute OS commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and cause the agent to run subprocess.run with shell=True, risking access to other tenants' data and server secrets.
CVSS v4.0
Score 8.7high
Affected software
jd-opensource
JoySafeter
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109443 describes a remote code execution vulnerability in jd-opensource's JoySafeter product through version 1.0.0. The flaw arises because the execute tool used in Copilot standard mode is unsandboxed, allowing authenticated users to run arbitrary operating system commands. Exploitation involves self-registration, selecting standard mode in the WebSocket chat.start extension, and triggering subprocess.run with shell=True on the host system. This improper isolation or compartmentalization can lead to unauthorized access to other tenants' data and sensitive server secrets.
Potential Impact
An attacker with authentication can execute arbitrary OS commands on the host, potentially compromising data confidentiality and integrity across tenants and exposing server secrets. This elevates the risk of full system compromise or data leakage within multi-tenant environments.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor access to the affected execute tool and avoid using Copilot standard mode in untrusted environments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T15:52:36.683Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad6c1952cdf04f656e49561
Added to database: 10/20/2026, 01:19:17 UTC
Last enriched: 10/20/2026, 01:48:24 UTC
Last updated: 10/20/2026, 01:48:24 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.