CVE-2026-27189

Katalog CVE

CVSS 5.8 · Medium EPSS 0,13%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada opensift. Skor CVSS 3.1 5.8 (Medium) menurut NVD.

Deskripsi (NVD)

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below, use non-atomic and insufficiently synchronized local JSON persistence flows, potentially causing concurrent operations to lose updates or corrupt local state across sessions/study/quiz/flashcard/wellness/auth stores. This issue has been fixed in version 1.1.3-alpha.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-3pmp-j953-whxq advisory vendor
• https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha product · release notes