Vulnerability Assessment

Overview

The goal of today is to practice the art of assessing the severity of a given vulnerability. Today, you will be going through several past vulnerabilities in major software products. You will need to answer two types of questions: one from the Common Vulnerability Scoring System (CVSS), and some other questions that can help developers identify vulnerabilities in the future.

In today’s discussion, we will be covering a number of recent vulnerabilities in real products. As with everything in real life, these are messy and don’t always fit into the logical buckets we have made. Thus, the assessment of each vulnerability is ultimately subjective. But, fortunately we can mitigate that subjectivity with multiple perspectives and lively discussion.

Setup

This activity is for 4-6 people, all at one table if possible.

  1. Go to this GoogleDoc spreadsheet template
  2. Make a copy of your own called “Vulnerability Assessment”.
  3. Share it with your instructor and course assistant so they can track your progress during class.
  4. Make sure everyone can edit the one sheet for your group.
  5. As a group, review lecture notes and CVSS specification. Answer any general questions about how this severity scoring works.

Activity

We’re going to conduct a Planning Poker-style discussion. Here’s how that works:

  1. Choose a vulnerability to review. Everyone takes a few minutes to review any details they need.
  2. Each team member writes down their votes on the questions. No peeking at each other’s votes ahead of time, but feel free to discuss the vulnerability prior to voting for any clarifications.
  3. Simultaneously reveal your votes. Don’t change your vote during this! Whatever you thought independently should be what you reveal.
  4. The two people who have the most opposite votes are the first ones allowed to speak.
  5. Discuss, and come as close to a consensus as you can.
  6. Do a new discussion for every entry in the spreadsheet, unless everyone feels it’s obvious.
  7. Did you finish all three? Head over to CVEDetails by CVSS score for more interesting examples.

Vulnerabilities

We want you to review the following vulnerabilities, in any order. Do not look up the CVSS score that was assigned in the NVD - no peeking!

CVE-2026-115754 XSS in serialize-javascript

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function’s source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.

Fix commit on GitHub: 2864b3c626

CVE-2026-115749 hydra-ray-launcher

hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

Fix commit on GitHub: 46e2fdaecd

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

Fix commit on GitHub: d03d0bc4994c

Submission & Grading

Share your document with your instructor and course assistant. They might provide feedback, but this will not be graded.