We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-3968

CVE-2026-3968

Express

Severity: MEDIUM
CVSS: 6.3CVSS
Published: 2026-03-12
Last modified: 2026-03-12
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE: CWE-74CWE-94

Description

A vulnerability has been found in AutohomeCorp frostmourne up to 1.0. This affects the function scriptEngine.eval of the file ExpressionRule.java of the component Oracle Nashorn JavaScript Engine. Such manipulation of the argument EXPRESSION leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://github.com/AnalogyC0de/public_exp/issues/17
https://vuldb.com/?ctiid.350397
https://vuldb.com/?id.350397
https://vuldb.com/?submit.768949

Summary

Description

References