Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-19360— wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management

Quick assessment

Affected

wongcyrus ExcelLexBot

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cyrus Wong Excel Lex Bot是Cyrus Wong个人开发者的一款通过 Microsoft Excel 来创建和管理 Amazon Lex 聊天机器人的工具。 Cyrus Wong Excel Lex Bot 0.0.3及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于Lambda Function Handler组件的ExcelLexBotS3TriggerFunction函数存在权限管理不当问题，攻击者可远程发起攻击。

CVSS 4.7 · Medium EPSS 0.38% · P32 Updated Aug 10, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
wongcyrus	ExcelLexBot	`0.0.1`	affected
		`0.0.2`	affected
		`0.0.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19360

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLexBotS3TriggerFunction of the component Lambda Function Handler. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

特权管理不恰当

Source: CVE Program / CVE List V5

Vulnerability Title

Cyrus Wong Excel Lex Bot 权限许可和访问控制问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
wongcyrus	ExcelLexBot	0.0.1	`cpe:2.3:a:wongcyrus:excellexbot::::::::`

II. Public POCs for CVE-2026-19360

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-19360

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-19360 (1)

Submit #866026: wongcyrus ExcelLexBot 0.0.3 and earlier Improper Access Controls third-party-advisory

Other References for CVE-2026-19360 (2)

CVE-2026-19360 in ExcelLexBot third-party-advisory
CVE-2026-19360 wongcyrus ExcelLexBot Lambda Function ExcelLexBotS3TriggerFunction privileges management vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-19360

IV. Related Vulnerabilities

Same weakness: CWE-269