glot-code-runner RCE

CRITICAL 9.8CVE-2018-15747 · GHSA-vj95-2f9q-x7h6 · Published 21/06/2019 · updated 17/06/2026

In short

CVE-2018-15747 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/prasmussen/glot-code-runner, glot-www (glot).
Chance of exploitation in the next 30 days (EPSS): 3.6%, higher than 89.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/prasmussen/glot-code-runner Go	`≤ 2018-05-19`	No fix yet
glot-www glot	`≤ 2018-05-19`	No fix yet

Description

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

NVD description

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.

References

nvd.nist.gov/vuln/detail/CVE-2018-15747 · ADVISORY
prasmussen/glot-code-runner · WEB
prasmussen/glot-code-runner · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free