CVE-2026-65843

CVSS 8.7 (high) · published 2026-11-11

sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.

Weakness: CWE-306

Source: NVD CVE-2026-65843

References

• https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07
• https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.