CVE-2026-65843
sync-rpc: Arbitrary remote code execution vulnerability
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.
| CWE | CWE-306 |
| Vendor | forbeslindesay |
| Product | sync-rpc |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for forbeslindesay sync-rpc
Be the first to know when new unknown vulnerabilities affecting forbeslindesay sync-rpc are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
ForbesLindesay / sync-rpc
< 1.3.7