VDB
GCVE-110-OSM-2026-4831
GCVE-110-OSM-2026-4831
Advisory PublishedCVSS 9.6/10
Suspected dependency confusion attack. Behaviors: code execution.
Entrypoint: client/index.js (default-index: index.js)
Exfil: http://localhost:8000/?canisterId=rwlgt-iiaaa-aaaaa-aaaaa-cai (reconstructed, recovery: reconstructed in lib/weavedb.js)
Payload: pages/index.js
Secondary files: lib/weavedb.js
Key findings:
- Reconstructed Obfuscated URL in lib/weavedb.js: "http://localhost:8000/?canisterId=rwlgt-iiaaa-aaaaa-aaaaa-cai"
- Dynamic Code Execution in pages/index.js: "eval(newFieldBool)"
IOCs:
- ipv4: 2.58.1.1, 14.18.2.28, 1.1.2.14, 31.23.34.49
- urls: http://goto/soy-param-migration, https://picsum.photos/1000/500, https://bit.dev/warashibe/nextdapp/core, http://localhost:8000/?canisterId=rwlgt-iiaaa-aaaaa-aaaaa-cai
- domains: registry.yarnpkg.com, arweave.net, bit.dev, event.notification.data.to, Ky.Cz (+2 more)
- emails: ig@G.Ry
- bitcoinAddresses: 1SfftUVuynzJu5XV2ur4i6VKVFE
- payloadFileHash: 739863d964f8a5c6b572bb857ba5f6b318a7e3b401918021665a7cb25423fd9a
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | weavedb-console | all (affected) | — |
Aliases
Browse GCVE Records
72,337 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.