CVE-2026-109443

JoySafeter is a platform with an AI chat assistant (Copilot). This flaw is like giving every logged-in guest a master key to the building's control room disguised as a chatbot feature — a regular user can make the assistant run commands directly on the server, letting them snoop on other customers' data or steal secret credentials stored there. No special hacking skill is needed, just a normal account on the system.

This matters to you if you use JoySafeter (version 1.0.0 or earlier), especially if you host multiple customers/tenants on the same instance or use the Copilot Standard Mode chat feature. Anyone who can register or already has a valid login to your JoySafeter instance can attempt this attack.

There is no confirmed active exploitation and no public exploit code circulating yet, so this is not an emergency fire-drill today — but the flaw requires only a low-privilege login and no user interaction, making it an easy target once attackers notice it. Because there is no vendor patch available yet, you should actively limit exposure now rather than wait.

1. Inventory all JoySafeter deployments and confirm version (affected: through 1.0.0). 2. Identify whether Copilot Standard Mode / chat.start WebSocket extension is enabled; if so, disable it as a temporary workaround since the execute tool invokes subprocess.run with shell=True without sandboxing. 3. Restrict new self-registration and review existing low-privilege accounts, as PR:L (low privilege) is sufficient to trigger the flaw. 4. Monitor the vendor's advisories/changelog for a fix — none is published at this time; track for a security release and apply it immediately once available. 5. In the interim, monitor server process execution logs and outbound command activity from the JoySafeter host for signs of shell command abuse or cross-tenant data access. 6. Rotate any server secrets potentially exposed via this component as a precaution.

CVSS 3.1 score 8.8 (High), vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low complexity, requires low-privilege auth, no user interaction, full impact on confidentiality/integrity/availability. Weakness is CWE-653 (Insufficient Compartmentalization), manifesting as an unsandboxed command execution tool reachable via the chat.start WebSocket extension in Copilot Standard Mode, using subprocess.run with shell=True. Not listed in CISA KEV; no public exploit code identified; predicted exploitation likelihood is low with a flat trend. No patch has been released. Press attention is newly emerging, indicating early-stage disclosure rather than confirmed in-the-wild activity.