Read the docs
TI-2022-20296 Aliases CVE-2022-41955

Autolab is vulnerable to remote code execution (RCE) via MOSS functionality

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was discovered in Autolab's MOSS functionality, whereby an instructor with access to the feature might be able to execute code on the server hosting Autolab. This vulnerability has been patched in version 2.10.0. As a workaround, disable the MOSS feature if it is unneeded by replacing the body of `run_moss` in `app/controllers/courses_controller.rb` with `render(plain: "Feature disabled", status: :bad_request) && return`.

Why it matters now

EPSS 0.01556 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
autolabAutolab2.0.1 – 2.9.0—No fix listedCNA
  • Autolab Vendorautolab Affected 2.0.1 – 2.9.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:*2.0.2 to before 2.10.0Vulnerableautolab
  • cpe:2.3:a:autolabproject:autolab:*:*:*:*:*:*:*:* Versions 2.0.2 to before 2.10.0 Vulnerable ·autolab

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41955

References

Advisory 1

Other 1

  • TI-2023-15952 Autolab tar slip in Install Assessment functionality (`GHSL-2023-081`) CVSS 3.1HIGH 7.2
  • TI-2023-15611 Autolab tar slip in cheat checker functionality (`GHSL-2023-082`) CVSS 3.1HIGH 7.2
  • TI-2022-20297 Autolab is vulnerable to file disclosure via remote handin feature CVSS 3.1MEDIUM 6.5
  • TI-2024-35721 download_all_submissions allows student to download another student's submissions in Autolab CVSS 4.0HIGH 7.1
  • TI-2024-32961 Autolab Has Misconfigured Reset Password Permissions CVSS 4.0HIGH 7.1
  • TI-2024-35723 Course Roster vulnerable to CSV Injection in Autolab CVSS 3.1MEDIUM 6.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences