Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85639

jofpin trape Telemetry Endpoint user.py race condition

CVSS 4.0 6.3 MEDIUMCVSS 3.1 5.6 MEDIUMCVSS 3.0 5.6 MEDIUMCVSS 2.0 5.1 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85639

Published

A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. The attack can be executed remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85639

Published

trape

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "jofpin",
                    "product": "trape",
                    "versions": [
                        {
                            "version": "2.0",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:jofpin:trape:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Telemetry Endpoint"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON