Description
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue.
References (2)
Core 2
Core References
Patch, Third Party Advisory
https://github.com/4ra1n/super-xray/commit/4d0d59663596db03f39d7edd2be251d48b52dcfc
Exploit, Third Party Advisory
https://github.com/4ra1n/super-xray/security/advisories/GHSA-39pv-4vmj-c4fr
Scores
CVSS v3
7.3
EPSS
0.0029
EPSS Percentile
52.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-502
Status
published
Products (1)
super_xray_project/super_xray
< 0.7
Published
Nov 25, 2022
Tracked Since
Feb 18, 2026