CVE-2026-2869: 
NixOS vulnerability analysis and mitigation

CVE-2026-2869 is an out-of-bounds read vulnerability in the handleattr function within src/core/specials.c of the janet-lang/janet programming language runtime, affecting all versions up to and including 1.40.1. The flaw was discovered via fuzzing and reported on January 23, 2026, with public disclosure on February 21, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local-only attack vector with high availability impact (Feedly, GitHub Issue).

The root cause is an off-by-one heap buffer over-read (CWE-125 / CWE-119) in the handleattr function in src/core/specials.c. Prior to the fix, the function accessed argv[0] to retrieve the binding name before validating that argn >= 2, meaning a malformed definition with fewer than two arguments (e.g., (def)tab @{}) caused the function to read 8 bytes immediately past the end of a heap-allocated tuple. The fix, applied in commit 2fabc80151a2b8834ee59cda8a70453f848b40e5, reorders the argument count check to occur before the argv[0] dereference. A public proof-of-concept reproducer and ASAN crash report are available (GitHub Issue, PoC Repo, Patch Commit).

Successful exploitation causes a heap-buffer-overflow read during Janet's compilation phase, leading to an application crash (denial of service). There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability. Because the attack requires local access and low privileges, the blast radius is constrained to systems where untrusted local users can submit Janet source code for compilation or evaluation (Feedly, GitHub Issue).

Public proof-of-concept code is available in two locations: the original bug report on GitHub and a standalone reproducer repository (GitHub Issue, PoC Repo). The EPSS score is approximately 0.013% (0.000130), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Obtain local access: Gain low-privilege local access to a system running janet-lang/janet version 1.40.1 or earlier, or access to an application that embeds Janet and evaluates user-supplied code.
2. Craft malformed Janet source: Prepare a Janet source file containing a malformed def or defn form with fewer than two arguments to handleattr, such as:

   (defn sum3
     "Solve the 3SUM problem in O(n^2) time."
     [s]
     (def)tab @{})

3. Trigger compilation: Pass the crafted file to the Janet interpreter or the embedding harness (e.g., ./janet repro or via janet_dostring() in an embedded context). The compiler invokes janetc_def → handleattr, which reads argv[0] before checking argn >= 2.
4. Observe crash: The out-of-bounds read of 8 bytes past the end of the heap-allocated tuple triggers an ASAN abort or a segmentation fault, crashing the Janet process or the host application (GitHub Issue, PoC Repo).

• Process: Unexpected crash or abort of the janet binary or any application embedding Janet; ASAN output containing heap-buffer-overflow in handleattr at src/core/specials.c:311.
• Logs: Application logs showing AddressSanitizer: heap-buffer-overflow or segmentation fault signals originating from Janet compilation routines; stack traces referencing handleattr, janetc_def, janetc_value, or janet_compile.
• File System: Presence of suspicious Janet source files (e.g., files containing (def) or (defn ... (def)...) patterns with malformed argument counts) in directories processed by Janet.
• Network: In embedded/server contexts, unexpected process termination or restart events correlated with receipt of user-supplied Janet code inputs (GitHub Issue).

Upgrade janet-lang/janet to version 1.41.0 or later, which contains the fix in commit 2fabc80151a2b8834ee59cda8a70453f848b40e5. No configuration-based workaround is available; the only remediation is upgrading. Systems where untrusted local users can submit Janet code for evaluation should be prioritized (Patch Commit, v1.41.0 Release).