The vulnerability stems from missing sandboxing on the /workspace/* routes in the pwn.college Dojo platform. A challenge author can inject arbitrary JavaScript that executes with the same origin as dojo.website. This enables the execution of any actions the user can perform, potentially exposing sensitive data or modifying site state. The flaw falls under CWE‑20 and CWE‑79.

All releases of pwncollege:dojo prior to commit e33da14449a5abcff507e554f66e2141d6683b0a are affected. The commit introduces proper sandboxing that mitigates the flaw.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers are likely limited to challenge authors who can craft malicious challenges; once a challenge is loaded, any user visiting the page may suffer arbitrary JavaScript execution. The exploit is straightforward once the malicious challenge is deployed, but requires the author role or permission to inject content into /workspace/*.