CVE-2026-65843— sync-rpc: Arbitrary remote code execution vulnerability

Quick assessment

Affected

ForbesLindesay sync-rpc

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

sync-rpc 通过将异步命令放入独立进程来实现同步执行。在 1.3.7 版本之前，如果攻击者能够猜中正确的端口，且该端口未通过防火墙进行阻断，则攻击者可以加载并执行存储在运行 sync-rpc 的服务器上的任意 JavaScript 文件。该问题已在 1.3.7 版本中修复。

CVSS 8.7 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution

Affected Version Matrix 1

Vendor	Product	Version Range	Status
ForbesLindesay	sync-rpc	`< 1.3.7`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

sync-rpc: Arbitrary remote code execution vulnerability

Source: CVE Program / CVE List V5

Vulnerability Description

sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an attacker could guess the correct port and it was not blocked via a firewall, it was possible to load and execute arbitrary JavaScript files stored on the server running sync-rpc. This issue has been patched in version 1.3.7.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ForbesLindesay	sync-rpc	< 1.3.7	-

II. Public POCs for CVE-2026-65843

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-65843

请登录查看更多情报信息。

Other References for CVE-2026-65843 (2)

https://github.com/ForbesLindesay/sync-rpc/security/advisories/GHSA-2x86-cf3f-86gw x_refsource_CONFIRM
https://github.com/ForbesLindesay/sync-rpc/commit/ffccfe5bc39ad2e291a79c9e5afe6155ad311f07 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-65843

IV. Related Vulnerabilities

Same weakness: CWE-306