CVE-2026-3955: elecV2P Code Injection RCE Vulnerability

CVE-2026-3955 Overview

A code injection vulnerability has been discovered in elecV2P, an automation tool and proxy server, affecting versions up to 3.8.3. The vulnerability exists in the runJSFile function within the file source-code/elecV2P-master/webser/wbjs.js of the jsfile Endpoint component. This security flaw allows attackers to inject and execute arbitrary code through manipulation of the affected function. The vulnerability can be exploited remotely over the network by authenticated attackers, potentially compromising the integrity, confidentiality, and availability of affected systems.

Critical Impact

Remote code injection vulnerability in elecV2P allows authenticated attackers to execute arbitrary code through the jsfile endpoint, potentially leading to full system compromise.

Affected Products

• elecV2P versions up to 3.8.3
• Systems running the affected wbjs.js component
• Deployments exposing the jsfile endpoint to network access

Discovery Timeline

• 2026-03-11 - CVE-2026-3955 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-3955

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-74), which occurs when software constructs all or part of a code segment using externally-influenced input but fails to neutralize special elements that could modify the intended syntax or behavior. In the case of elecV2P, the runJSFile function in the jsfile endpoint does not properly sanitize user-supplied input before processing, allowing attackers to inject malicious code.

The vulnerability exists in the wbjs.js file, which handles JavaScript file execution requests. When processing requests to the jsfile endpoint, the application fails to implement adequate input validation, enabling code injection attacks. The exploit has been publicly disclosed through a GitHub issue, increasing the urgency for remediation.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the runJSFile function. The function appears to accept external input and incorporates it into code execution paths without properly escaping or validating the content. This allows specially crafted input to break out of the intended execution context and inject arbitrary code.

Attack Vector

The attack can be launched remotely over the network. An authenticated attacker with low privileges can exploit this vulnerability by sending specially crafted requests to the jsfile endpoint. The attack does not require user interaction and can be executed with low complexity.

The exploitation flow involves:

1. Authenticating to the elecV2P application with valid credentials
2. Crafting a malicious request targeting the jsfile endpoint
3. Injecting code through the vulnerable runJSFile function parameter
4. Achieving code execution within the context of the elecV2P application

Technical details regarding the specific exploitation technique can be found in the GitHub Issue Discussion.

Detection Methods for CVE-2026-3955

Indicators of Compromise

• Unusual requests to the jsfile endpoint containing suspicious payloads or encoded content
• Unexpected JavaScript file execution or process spawning from the elecV2P application
• Log entries showing malformed or injection-pattern requests to /wbjs or related endpoints
• New or modified files in the elecV2P directory structure that were not created by administrators

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block code injection patterns targeting the jsfile endpoint
• Monitor application logs for suspicious requests containing code injection signatures such as special characters, encoded payloads, or script fragments
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process behavior originating from elecV2P

Monitoring Recommendations

• Enable verbose logging for the elecV2P application to capture all requests to the jsfile endpoint
• Set up alerts for authentication events followed by requests to sensitive endpoints like jsfile
• Monitor system processes for unexpected child processes spawned by the elecV2P application
• Review network traffic for unusual outbound connections from the elecV2P server

How to Mitigate CVE-2026-3955

Immediate Actions Required

• Restrict network access to the elecV2P jsfile endpoint to trusted IP addresses only
• Implement strong authentication controls and review user privileges to minimize the attack surface
• Consider temporarily disabling the jsfile endpoint functionality until a patch is available
• Deploy a web application firewall with rules to detect and block code injection attempts

Patch Information

As of the last update, the elecV2P project has been notified of this vulnerability through an issue report but has not yet responded or released an official patch. Organizations using elecV2P should monitor the GitHub repository for updates and apply any security patches as soon as they become available.

For additional vulnerability intelligence, refer to the VulDB entry.

Workarounds

• Implement network segmentation to isolate elecV2P instances from untrusted networks
• Use a reverse proxy with input validation to filter malicious requests before they reach the application
• Restrict the jsfile endpoint to localhost-only access if remote functionality is not required
• Implement additional authentication layers such as VPN access requirements for administrative functions

# Configuration example - Restrict access using iptables
# Allow only trusted IP addresses to access elecV2P port
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Alternative: Use nginx as reverse proxy with rate limiting
# Add to nginx configuration to limit requests to jsfile endpoint
# location /jsfile {
#     limit_req zone=jsfile_limit burst=5 nodelay;
#     proxy_pass http://localhost:elecv2p_port;
# }