elecV2 elecV2P JSON webhook runJSFile 代码注入

The vulnerability allows a remote attacker to inject and execute arbitrary code on a system running elecV2 or elecV2P. This could lead to complete system compromise, including data theft, modification, or deletion. Given the public availability of an exploit, the potential for widespread exploitation is high. The /webhook endpoint suggests this vulnerability could be exploited through external integrations or API calls, expanding the attack surface. Successful exploitation could also allow for lateral movement within the network if the affected system has access to other sensitive resources.

Organizations utilizing elecV2 or elecV2P in production environments, particularly those with external integrations or API endpoints that interact with the /webhook functionality, are at significant risk. Systems with weak input validation or lacking WAF protection are especially vulnerable. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's instance could potentially affect others.

• nodejs: Monitor process execution for unusual JavaScript code being run. Use ps aux | grep node to identify processes running elecV2/elecV2P. Check for suspicious network connections originating from the affected processes using netstat -anp | grep elecV2.

ps aux | grep elecV2

• generic web: Examine access logs for requests to /webhook with unusual or excessively long rawcode parameters. Look for POST requests containing JavaScript code in the request body.

grep '/webhook' access.log | grep -i javascript

1. 2026-03-28Disclosure

   disclosure

1. 已保留2026-03-27
2. 发布日期2026-03-28
3. 修改日期2026-03-30
4. EPSS 更新日期2026-04-04

The primary mitigation is to upgrade to a patched version of elecV2 or elecV2P. As of this writing, no patched version has been released. Until a patch is available, consider implementing temporary workarounds. Input validation on the /webhook endpoint is crucial; strictly validate and sanitize the rawcode argument to prevent malicious code injection. Implementing a Web Application Firewall (WAF) with rules to detect and block suspicious payloads targeting the /webhook endpoint can provide an additional layer of defense. Monitor system logs for unusual activity related to the /webhook endpoint and the JSON Parser component.