CVE-2026-2242: 
NixOS vulnerability analysis and mitigation

CVE-2026-2242 is an out-of-bounds read vulnerability in the janetc_if function of janet-lang/janet, a dynamic scripting language and bytecode VM. It affects janet-lang janet versions up to and including 1.40.1, specifically in src/core/specials.c. The vulnerability was publicly disclosed on February 9, 2026, with proof-of-concept exploit code available. It carries a CVSS v3.1 base score of 6.1 (Medium) (Feedly, GitHub Issue #1700).

The root cause is an improper bounds check in the janetc_if compiler function (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). During compilation/linting of Janet source code, the function writes jump label offsets into a compiler buffer (c->buffer) without first verifying that the buffer index labeljr is within the allocated bounds — specifically, the code at line 690 of specials.c unconditionally performs c->buffer[labeljr] |= (labelr - labeljr) << 16 even when labeljr >= labeld, causing a 4-byte read/write 0 bytes past the end of a 24-byte heap-allocated region. The fix (commit c43e06672cd9dacf2122c99f362120a17c34b391) adds a bounds check: if (labeljr < labeld) before the buffer access. Exploitation requires a locally executed, malformed Janet source file — particularly a crafted if expression nested within a function definition inside a destructuring def — to trigger the flaw during janet_compile_lint (GitHub Issue #1700, Patch Commit).

Successful exploitation can cause the Janet interpreter or any embedding application to crash (denial of service via heap-buffer-overflow), and may result in limited leakage of heap memory contents due to the out-of-bounds read. The vulnerability is limited to the local attack vector, meaning an attacker must be able to supply malicious Janet source code to a vulnerable interpreter or embedded application. There is no integrity impact, and confidentiality impact is rated low, as only adjacent heap memory may be exposed (Feedly, GitHub Issue #1700).

Multiple proof-of-concept exploits are publicly available, including two GitHub issues with full ASAN crash reports and a reproduction file hosted at a public repository (GitHub Issue #1700, GitHub Issue #1702, PoC Repro). The bugs were discovered via fuzzing. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the wild (Feedly). The vulnerability is not listed in the CISA KEV catalog.

1. Prepare a malicious Janet source file: Craft a Janet script containing a malformed if expression nested within a function definition inside a destructuring def, such as:

(defn fuzz-case-1
  [start end &]
  (if end
    (if e start (lazy-range (+ 1 start) end)))
  1)

This pattern triggers the missing bounds check in janetc_if during compilation.

2. Build or obtain a vulnerable Janet binary: Obtain janet-lang/janet version 1.40.1 or earlier. For crash confirmation, build with ASan enabled (clang -fsanitize=address).

3. Execute the malicious script: Run the crafted file through the Janet interpreter or a harness that calls janet_dostring/janet_dobytes:

./janet repro
# or via harness:
./harness repro

4. Observe crash: The interpreter crashes with a heap-buffer-overflow in janetc_if at specials.c:690, reading 4 bytes past the end of a 24-byte heap region, as confirmed by ASAN output (GitHub Issue #1700, PoC Repro).

• Process: Unexpected crash or abort of the janet interpreter process or any application embedding Janet (e.g., via janet_dostring/janet_dobytes), particularly when processing untrusted Janet source files.
• Logs: ASAN or sanitizer output referencing heap-buffer-overflow in janetc_if at src/core/specials.c:690 or janetc_pop_funcdef at src/core/compile.c:965; stack traces involving janet_compile_lint -> janetc_def -> dohead_destructure -> janetc_fn -> janetc_if.
• File System: Presence of unexpected or externally supplied .janet source files containing deeply nested if expressions within function definitions inside destructuring def forms.
• Network: If Janet is used as a scripting engine in a networked application, unexpected connection drops or service restarts correlated with processing of user-supplied Janet code (GitHub Issue #1700, GitHub Issue #1702).

Apply the upstream patch commit c43e06672cd9dacf2122c99f362120a17c34b391, which adds a bounds check (if (labeljr < labeld)) before the buffer write in janetc_if. Upgrade to a version of janet-lang/janet that includes this fix (released after version 1.40.1; the latest release at time of disclosure is 1.41.2). As a workaround where upgrading is not immediately possible, restrict local access to systems running vulnerable Janet versions and avoid processing untrusted Janet source files (Patch Commit, Feedly).

The vulnerability was discovered and reported by researcher "oneafter" via fuzzing, with detailed ASAN crash reports filed as GitHub issues on January 23, 2026. The janet-lang maintainer (bakpakin) promptly addressed the issue with a patch commit referencing issue #1700. No significant broader media coverage or notable community debate has been identified beyond the GitHub issue tracker (GitHub Issue #1700, Patch Commit).