The vulnerability in janet’s variable setting function allows an attacker with local access to read beyond the intended buffer boundaries. This out‑of‑bounds read can leak data that is not meant to be exposed, such as process memory contents or sensitive configuration values. The flaw is a classic buffer over‑read classified as CWE‑119 and CWE‑125, and the consequence is that an attacker can gather information about the system or the application without altering state or executing code.

It affects all versions of the janet‑lang JANet interpreter up to and including 1.40.1. The flaw resides in the handleattr component’s janetc_varset function within src/core/specials.c. Users who run versions prior to 1.41.0 are vulnerable. Upgrading to 1.41.0 resolves the issue. The vendor is janet‑lang.

The CVSS score of 4.8 reflects a moderate risk, and the EPSS score indicates the probability of exploitation is very low (<1 %). The vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed exploitation in the wild. The attack vector is local, so only users or processes with local privileges can abuse the flaw. Because an official patch is available, the risk is mitigated by upgrading. The danger is limited to an information leak, but it should still be remedied to avoid accidental disclosure.