Live › vulnerability › CVE-2026-109443
Go to dashboardJoySafeter (jd-opensource) through 1.0.0: the Copilot WebSocket chat.start extension takes a client-chosen mode. Any value other than the default 'deepagents' (e.g. 'standard') routes to a host-shell agent. That agent has an auto-added execute tool running subprocess.run(shell=True) on the server, with no sandbox, allow list or approval. Any authenticated tenant can run commands as the service user, reading env secrets and other tenants' data. The default mode has no shell. Lasso gives a benign PoC (ask the agent to run id). No fix released as of 2026-10-23; no known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| JoySafeter | github | <= 1.0.0 | – |
1.0.0 (git commit 12234a1 or earlier, or release tag v1.0.0)deepagents to get_copilot_agent, you are exposeddeepagents and for execute tool callsv1.0.0 is latest; upstream fix not found)deepagents copilot mode server-side (force mode=deepagents), or exclude the execute tool via excluded_tools and add interrupt_on approvalEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-109443")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.