CVE-2024-28189

CVE-2024-28189 is a critical vulnerability in Judge0, an open-source online code execution system, affecting versions prior to 1.13.1. It allows an attacker to bypass the sandbox by creating a symbolic link to an arbitrary file, enabling the chown command to be executed outside the sandbox. This vulnerability has a CVSS score of 10.0 (Critical) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, potentially leading to a complete sandbox escape. While not directly impactful, it is crucial for bypassing the patch for CVE-2024-28185. Exploit code is publicly available via a Metasploit module, and it has garnered significant community discussion and media coverage, indicating active awareness and potential for exploitation.