{"id":"CVE-2026-109443","kind":"vulnerability","aliases":["CVE-2026-109443"],"related":[],"title":"JoySafeter: authenticated users run OS commands through Copilot agent","description":"JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.","summary":"JoySafeter (jd-opensource) through 1.0.0: the Copilot WebSocket chat.start extension takes a client-chosen mode. Any value other than the default 'deepagents' (e.g. 'standard') routes to a host-shell agent. That agent has an auto-added execute tool running subprocess.run(shell=True) on the server, with no sandbox, allow list or approval. Any authenticated tenant can run commands as the service user, reading env secrets and other tenants' data. The default mode has no shell. Lasso gives a benign PoC (ask the agent to run id). No fix released as of 2026-10-23; no known exploitation.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JoySafeter","fixed":[],"affected":"<= 1.0.0","ecosystem":"github"}],"ecosystems":[],"tags":["agent","ai-tooling","joysafeter","multi-tenant","rce","self-hosted"],"not_affected_if":["auth-required","no-untrusted-users","registration-disabled","single-user","standard-mode-disabled"],"how_to_check":"Check whether you run JoySafeter <= 1.0.0 (git commit 12234a1 or earlier, or release tag v1.0.0). Check whether users can self-register and whether the backend WebSocket is reachable. Review backend/app/services/copilot_service.py: if _get_copilot_stream still routes any mode other than 'deepagents' to get_copilot_agent, you are exposed. Check logs for chat.start frames with extension.mode other than 'deepagents' and for execute tool calls.","fix":"No patched release known (v1.0.0 is latest; upstream fix not found). Mitigate now: disable open self-registration, block or reject non-'deepagents' copilot mode server-side (force mode=deepagents), or exclude the execute tool via excluded_tools and add interrupt_on approval. Better: route the standard agent through the Docker sandbox (DockerSandbox/PydanticSandboxAdapter), and run the backend as an unprivileged user with minimal secrets. Rotate secrets on any exposed multi-tenant instance.","status":"open","published_at":"2026-10-20T01:17:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:32:57+00:00","updated_at":"2026-10-23T22:35:17+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:32:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JoySafeter: authenticated users run OS commands through Copilot agent","impact":"high","summary":"JoySafeter's Copilot standard mode exposes an unsandboxed execute tool that runs shell commands on the host. A self-registered user can reach it over WebSocket and read other tenants' data and server secrets.","category":"ai-tooling","who_cares":["joysafeter","self-hosted","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Shell commands run on the host; other tenants' data and server secrets readable","analyst_note":"Check the NVD entry and the JoySafeter repo for a patched version and whether self-registration is enabled by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","standard-mode-disabled"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000463,"input_tokens":2939,"output_tokens":339,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the JoySafeter repo for a patched version and whether self-registration is enabled by default.","search":"'-10':125B '-109443':12A,15A '-2026':11A,14A '-23':126B '1.0.0':34B,132C '2026':124B 'access':183C 'add':68B 'agent':9A,17B,61B,63B,115B,173C 'ai':19B 'ai-tool':18B 'allow':81B,140C 'approv':84B 'ask':113B 'attack':157C 'authent':2A,86B,141C 'auto':67B 'auto-ad':66B 'benign':111B 'chat.start':38B,168C 'chosen':44B 'client':43B 'client-chosen':42B 'code':136C 'command':6A,90B,147C 'contain':133C 'copilot':8A,36B,154C 'cve':10A,13A 'data':101B,186C 'deepag':52B 'default':51B,103B 'e.g':53B 'env':96B 'execut':69B,137C,151C 'exploit':129B 'extens':39B,169C 'fix':120B 'give':109B 'host':28B,59B,181C 'host-shel':58B 'id':118B 'invok':174C 'jd':31B 'jd-opensourc':30B 'joysafet':1A,21B,29B,130C 'joysafeter':16A 'known':128B 'lasso':108B 'list':82B 'mode':45B,104B,156C,164C 'multi':23B 'multi-ten':22B 'opensourc':32B 'oper':145C 'os':5A 'poc':112B 'rce':25B 'read':95B 'regist':161C 'releas':121B 'remot':135C 'rout':55B 'run':4A,71B,89B,117B,144C 'sandbox':80B 'secret':97B,189C 'select':162C 'self':27B,160C 'self-host':26B 'self-regist':159C 'server':77B,188C 'servic':93B 'shell':60B,73B,107B,177C 'standard':54B,155C,163C 'subprocess.run':72B,175C 'system':146C 'take':40B 'tenant':24B,87B,100B,185C 'tool':20B,70B,152C 'true':74B,178C 'unsandbox':150C 'user':3A,94B,142C 'valu':47B 'via':148C 'vulner':138C 'websocket':37B,167C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109443","severity":null,"published_at":"2026-10-20T01:17:10+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109443:254","url":null,"severity":null,"published_at":"2026-10-23T22:35:17+00:00","modified_at":"2026-10-23T22:35:17+00:00","first_seen_at":"2026-10-23T22:35:17+00:00","fetched_at":"2026-10-23T22:35:17+00:00","note":"Read Lasso and VulnCheck advisories, v1.0.0 release page and copilot_service.py. No patched version exists (v1.0.0 is latest). Self-registration default not verified. Lasso says CVSS 9.9 and no known exploit, VulnCheck CVNA v4 8.7; severity left unchanged. Social: 2 X posts in 7d, nothing worth saving."}],"documents":[{"id":1515,"url":"https://www.lasso.security/vulnerability-database/cve-2026-109443","title":"Lasso: CVE-2026-109443 JoySafeter authenticated RCE (PoC, remediation)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1516,"url":"https://www.vulncheck.com/advisories/joysafeter-through-1.0.0-authenticated-rce-via-copilot-standard-mode-shell","title":"VulnCheck advisory: JoySafeter <= 1.0.0","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1518,"url":"https://github.com/jd-opensource/JoySafeter/releases","title":"JoySafeter releases (latest v1.0.0)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1521,"url":"https://github.com/jd-opensource/JoySafeter/blob/12234a11a9d96acef85577afb1fa5682169d6171/backend/app/services/copilot_service.py","title":"copilot_service.py at v1.0.0: mode != deepagents routes to host-shell agent","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}