{"id":"CVE-2026-65843","kind":"vulnerability","aliases":["CVE-2026-65843"],"related":[],"title":"sync-rpc: attacker can run arbitrary JavaScript files on the server","description":"sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.","summary":"sync-rpc runs asynchronous commands synchronously by sending them to a separate process over a local port. Prior to 1.3.7, an attacker who could guess that port and reach it (no firewall block) could load and execute arbitrary JavaScript files stored on the server.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","self-hosted","sync-rpc"],"not_affected_if":["port-firewalled","version-1.3.7-or-later"],"how_to_check":"- Check the installed version: `npm ls sync-rpc`\n- Check whether `sync-rpc` is a direct or transitive dependency in `package-lock.json` or `yarn.lock`\n- Check whether the server's port used by sync-rpc is reachable from outside the host (firewall rules)","fix":"- `sync-rpc` `1.3.7`","status":"open","published_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","triaged_at":"2026-11-11T19:29:50+00:00","updated_at":"2026-11-11T19:29:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T19:29:50Z","model":"claude-haiku-5-5","output":{"fix":"- `sync-rpc` `1.3.7`","reach":"network","title":"sync-rpc: attacker can run arbitrary JavaScript files on the server","impact":"high","summary":"sync-rpc runs asynchronous commands synchronously by sending them to a separate process over a local port. Prior to 1.3.7, an attacker who could guess that port and reach it (no firewall block) could load and execute arbitrary JavaScript files stored on the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","sync-rpc","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"arbitrary JavaScript runs on the server","analyst_note":"","how_to_check":"- Check the installed version: `npm ls sync-rpc`\n- Check whether `sync-rpc` is a direct or transitive dependency in `package-lock.json` or `yarn.lock`\n- Check whether the server's port used by sync-rpc is reachable from outside the host (firewall rules)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.3.7-or-later","port-firewalled"],"who_is_affected":"Applications that depend on sync-rpc below 1.3.7 and run it on a server where its port can be reached by an attacker. Exposure depends on whether the port is blocked by a firewall; the sources do not say whether the port is otherwise reachable by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4588,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65843':15A,18A '1.3.7':47B,89C,131C 'arbitrari':7A,65B,113C 'asynchron':31B,76C 'attack':4A,49B,92C 'block':60B,102C 'command':32B,77C 'correct':96C 'could':51B,61B,93C 'cve':13A,16A 'execut':64B,112C 'file':9A,67B,115C 'firewal':59B,105C 'guess':52B,94C 'host':23B 'issu':125C 'javascript':8A,66B,114C 'load':62B,110C 'local':43B 'node':19B 'packag':20B 'patch':128C 'port':44B,54B,97C 'possibl':108C 'prior':45B,86C 'proce':85C 'process':40B 'put':80C 'reach':56B 'rpc':3A,26B,29B,74C,123C 'run':6A,30B,75C,120C 'self':22B 'self-host':21B 'send':35B 'separ':39B,84C 'server':12A,71B,119C 'store':68B,116C 'sync':2A,25B,28B,73C,122C 'sync-rpc':1A,24B,27B,72C,121C 'synchron':33B,78C 'version':88C,130C 'via':103C","nicknames":[],"mitigations":[],"who_affected":"Applications that depend on sync-rpc below 1.3.7 and run it on a server where its port can be reached by an attacker. Exposure depends on whether the port is blocked by a firewall; the sources do not say whether the port is otherwise reachable by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","node","package","selfhosted","syncrpc"],"campaign_type":null,"search_a":"'-2026':14A,17A '-65843':15A,18A 'arbitrari':7A 'attack':4A 'cve':13A,16A 'file':9A 'javascript':8A 'rpc':3A 'run':6A 'server':12A 'sync':2A 'sync-rpc':1A","search_b":"'1.3.7':47B 'arbitrari':65B 'asynchron':31B 'attack':49B 'block':60B 'command':32B 'could':51B,61B 'execut':64B 'file':67B 'firewal':59B 'guess':52B 'host':23B 'javascript':66B 'load':62B 'local':43B 'node':19B 'packag':20B 'port':44B,54B 'prior':45B 'process':40B 'reach':56B 'rpc':26B,29B 'run':30B 'self':22B 'self-host':21B 'send':35B 'separ':39B 'server':71B 'store':68B 'sync':25B,28B 'sync-rpc':24B,27B 'synchron':33B","search_c":"'1.3.7':89C,131C 'arbitrari':113C 'asynchron':76C 'attack':92C 'block':102C 'command':77C 'correct':96C 'could':93C 'execut':112C 'file':115C 'firewal':105C 'guess':94C 'issu':125C 'javascript':114C 'load':110C 'patch':128C 'port':97C 'possibl':108C 'prior':86C 'proce':85C 'put':80C 'rpc':74C,123C 'run':75C,120C 'separ':84C 'server':119C 'store':116C 'sync':73C,122C 'sync-rpc':72C,121C 'synchron':78C 'version':88C,130C 'via':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T15:38:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65843","severity":null,"published_at":"2026-11-11T19:17:44+00:00","modified_at":"2026-11-11T19:17:44+00:00","first_seen_at":"2026-11-11T19:28:48+00:00","fetched_at":"2026-11-11T19:28:48+00:00","note":null}],"documents":[{"id":128149,"url":"https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128150,"url":"https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T15:38:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}