CVE-2026-2242
📋 TL;DR
This vulnerability in janet-lang allows local attackers to perform out-of-bounds read operations via the janetc_if function. It affects janet versions up to 1.40.1. The exploit requires local access to the system.
💻 Affected Systems
- janet-lang janet
📦 What is this software?
Janet by Janet Lang
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leading to potential privilege escalation or system compromise through memory manipulation
Likely Case
Local information disclosure or application crash
If Mitigated
Minimal impact with proper access controls and isolation
🎯 Exploit Status
Exploit requires local access and has been publicly disclosed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.40.2 or later
Vendor Advisory: https://github.com/janet-lang/janet/commit/c43e06672cd9dacf2122c99f362120a17c34b391
Restart Required: Yes
Instructions:
1. Update janet to version 1.40.2 or later
2. Restart any services using janet
3. Recompile any janet-based applications
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running vulnerable janet versions
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Isolate janet applications in containers or VMs with minimal permissions
🔍 How to Verify
Check if Vulnerable:
Check janet version with 'janet -v' or examine installed packagesCheck Version:
janet -vVerify Fix Applied:
Verify version is 1.40.2 or later and check for commit c43e06672cd9dacf2122c99f362120a17c34b391📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violations
- Unusual process behavior
Network Indicators:
- None - local exploit only
SIEM Query:
Process monitoring for janet crashes or memory access violations🔗 References
- https://github.com/janet-lang/janet/
- https://github.com/janet-lang/janet/commit/c43e06672cd9dacf2122c99f362120a17c34b391
- https://github.com/janet-lang/janet/issues/1700
- https://github.com/janet-lang/janet/issues/1702
- https://github.com/oneafter/0123/blob/main/ja2/repro
- https://vuldb.com/?ctiid.344981
- https://vuldb.com/?id.344981
- https://vuldb.com/?submit.754495
