Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading
Priority LOW 35CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential remote code execution, or other security breaches. Users utilizing versions of the Yak Engine prior to 1.2.4-sp1 are impacted. This vulnerability has been patched in version 1.2.4-sp1. Users are advised to upgrade. users unable to upgrade may avoid exposing vulnerable versions to untrusted input and to closely monitor any unexpected server behavior until they can upgrade.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01046 64th percentileScored 2026-11-07
Fix Fixed yaklang (yaklang): 1.2.4-sp1github.com/yaklang/yaklang (Go): 1.2.4-sp2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| yaklang | yaklang | before 1.2.4-sp1 | 1.2.4-sp1 | Patch available | CNA |
| — | github.com/yaklang/yaklang (Go) | before 1.2.4-sp2 | 1.2.4-sp2 | Patch available | GHSA-xvhg-w6qc-m3qq |
- yaklang Vendoryaklang Affected before 1.2.4-sp1 Fixed in 1.2.4-sp1 Patch available CNA
- github.com/yaklang/yaklang (Go) Vendor— Affected before 1.2.4-sp2 Fixed in 1.2.4-sp2 Patch available GHSA-xvhg-w6qc-m3qq
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yaklang:yaklang:1.2.0:sp6:*:*:*:*:*:* | 1.2.0 sp6 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.0:sp7:*:*:*:*:*:* | 1.2.0 sp7 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.0:sp8:*:*:*:*:*:* | 1.2.0 sp8 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:-:*:*:*:*:*:* | 1.2.1 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp1:*:*:*:*:*:* | 1.2.1 sp1 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp2:*:*:*:*:*:* | 1.2.1 sp2 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp3:*:*:*:*:*:* | 1.2.1 sp3 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp4:*:*:*:*:*:* | 1.2.1 sp4 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp5:*:*:*:*:*:* | 1.2.1 sp5 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp6:*:*:*:*:*:* | 1.2.1 sp6 | Vulnerable | yaklang |
- cpe:2.3:a:yaklang:yaklang:1.2.0:sp6:*:*:*:*:*:* Versions 1.2.0 sp6 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.0:sp7:*:*:*:*:*:* Versions 1.2.0 sp7 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.0:sp8:*:*:*:*:*:* Versions 1.2.0 sp8 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:-:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp1:*:*:*:*:*:* Versions 1.2.1 sp1 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp2:*:*:*:*:*:* Versions 1.2.1 sp2 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp3:*:*:*:*:*:* Versions 1.2.1 sp3 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp4:*:*:*:*:*:* Versions 1.2.1 sp4 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp5:*:*:*:*:*:* Versions 1.2.1 sp5 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp6:*:*:*:*:*:* Versions 1.2.1 sp6 Vulnerable ·yaklang
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp7:*:*:*:*:*:* | 1.2.1 sp7 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp8:*:*:*:*:*:* | 1.2.1 sp8 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.1:sp9:*:*:*:*:*:* | 1.2.1 sp9 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:-:*:*:*:*:*:* | 1.2.2 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp1:*:*:*:*:*:* | 1.2.2 sp1 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp2:*:*:*:*:*:* | 1.2.2 sp2 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp3:*:*:*:*:*:* | 1.2.2 sp3 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp4:*:*:*:*:*:* | 1.2.2 sp4 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp5:*:*:*:*:*:* | 1.2.2 sp5 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp6:*:*:*:*:*:* | 1.2.2 sp6 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.2:sp7:*:*:*:*:*:* | 1.2.2 sp7 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.3:-:*:*:*:*:*:* | 1.2.3 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.3:sp1:*:*:*:*:*:* | 1.2.3 sp1 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.3:sp2:*:*:*:*:*:* | 1.2.3 sp2 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.3:sp3:*:*:*:*:*:* | 1.2.3 sp3 | Vulnerable | yaklang |
| cpe:2.3:a:yaklang:yaklang:1.2.4:-:*:*:*:*:*:* | 1.2.4 | Vulnerable | yaklang |
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp7:*:*:*:*:*:* Versions 1.2.1 sp7 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp8:*:*:*:*:*:* Versions 1.2.1 sp8 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.1:sp9:*:*:*:*:*:* Versions 1.2.1 sp9 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:-:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp1:*:*:*:*:*:* Versions 1.2.2 sp1 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp2:*:*:*:*:*:* Versions 1.2.2 sp2 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp3:*:*:*:*:*:* Versions 1.2.2 sp3 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp4:*:*:*:*:*:* Versions 1.2.2 sp4 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp5:*:*:*:*:*:* Versions 1.2.2 sp5 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp6:*:*:*:*:*:* Versions 1.2.2 sp6 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.2:sp7:*:*:*:*:*:* Versions 1.2.2 sp7 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.3:-:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.3:sp1:*:*:*:*:*:* Versions 1.2.3 sp1 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.3:sp2:*:*:*:*:*:* Versions 1.2.3 sp2 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.3:sp3:*:*:*:*:*:* Versions 1.2.3 sp3 Vulnerable ·yaklang
- cpe:2.3:a:yaklang:yaklang:1.2.4:-:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·yaklang
Remediation
- Fix · CNA yaklang (yaklang) Fixed in 1.2.4-sp1
- Fix · GHSA-xvhg-w6qc-m3qq github.com/yaklang/yaklang (Go) Fixed in 1.2.4-sp2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40023
- 2026-10-03 Alias added: GHSA-xvhg-w6qc-m3qq
References
Advisory 2
Sources
- CVE-2023-40023 · CVE Program
- CVE-2023-40023 · NVD
- FIRST EPSS
- GHSA-xvhg-w6qc-m3qq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences