CVE-2023-30856

    Dashboard / Vulnerabilities / CVE-2023-30856

    CVE-2023-30856

    Published: 28 Apr 2023Last Modified: 12 Aug 2026

    Summary: eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

    Details: eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.

    References: https://christian-schneider.net/CrossSiteWebSocketHijacking.html, https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30856.json, https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9, https://nvd.nist.gov/vuln/detail/CVE-2023-30856

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v2.2.8
    v2.2.7
    v2.2.6
    v2.2.5
    v2.2.4
    v2.2.3
    v2.2.2
    v2.2.1
    v2.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-30856 | CVE-DB