CVE-2026-19360: Improper Privilege Management in wongcyrus ExcelLexBot
CVE-2026-19360 is a medium severity vulnerability in wongcyrus ExcelLexBot versions 0.0.1, 0.0.2, and 0.0.3 affecting the Lambda Function Handler component. It involves improper privilege management in the ExcelLexBotS3TriggerFunction, which can be exploited remotely. The product is no longer supported by the maintainer, and the vendor did not respond to disclosure attempts. The service is cloud-hosted, and a patch is indicated as available.
AI Analysis
Technical Summary
This vulnerability in wongcyrus ExcelLexBot up to version 0.0.3 affects the Lambda Function Handler's ExcelLexBotS3TriggerFunction component, allowing improper privilege management. The flaw can be triggered remotely without user interaction, potentially leading to limited confidentiality, integrity, and availability impacts. The product is no longer maintained, and the vendor did not respond to the vulnerability disclosure. The affected product is a cloud service, which typically implies vendor-managed remediation.
Potential Impact
The vulnerability allows improper privilege management remotely, which could lead to unauthorized actions within the affected Lambda function context. The CVSS 4.0 score of 5.1 (medium) reflects limited impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Since the product is no longer supported, risk may persist if unpatched.
Mitigation Recommendations
A patch is available for this vulnerability. Because the product is a cloud service, the vendor typically manages remediation server-side. However, the vendor did not respond to disclosure, and the product is no longer supported. Users should verify with the vendor or cloud service provider that the patch has been applied or consider discontinuing use of the affected versions.
CVE-2026-19360: Improper Privilege Management in wongcyrus ExcelLexBot
Description
CVE-2026-19360 is a medium severity vulnerability in wongcyrus ExcelLexBot versions 0.0.1, 0.0.2, and 0.0.3 affecting the Lambda Function Handler component. It involves improper privilege management in the ExcelLexBotS3TriggerFunction, which can be exploited remotely. The product is no longer supported by the maintainer, and the vendor did not respond to disclosure attempts. The service is cloud-hosted, and a patch is indicated as available.
CVSS v4.0
Score 5.1medium
Affected software
wongcyrus
ExcelLexBot
pkg:npm/wongcyrus/excellexbotcpe:2.3:a:wongcyrus:excellexbot:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in wongcyrus ExcelLexBot up to version 0.0.3 affects the Lambda Function Handler's ExcelLexBotS3TriggerFunction component, allowing improper privilege management. The flaw can be triggered remotely without user interaction, potentially leading to limited confidentiality, integrity, and availability impacts. The product is no longer maintained, and the vendor did not respond to the vulnerability disclosure. The affected product is a cloud service, which typically implies vendor-managed remediation.
Potential Impact
The vulnerability allows improper privilege management remotely, which could lead to unauthorized actions within the affected Lambda function context. The CVSS 4.0 score of 5.1 (medium) reflects limited impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Since the product is no longer supported, risk may persist if unpatched.
Mitigation Recommendations
A patch is available for this vulnerability. Because the product is a cloud service, the vendor typically manages remediation server-side. However, the vendor did not respond to disclosure, and the product is no longer supported. Users should verify with the vendor or cloud service provider that the patch has been applied or consider discontinuing use of the affected versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-08T18:58:56.459Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a78b896bf8831d539fa67b5
Added to database: 08/09/2026, 17:27:50 UTC
Last enriched: 08/17/2026, 15:55:54 UTC
Last updated: 09/22/2026, 01:54:38 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.