CVE-2026-93943

{
  "etk_id": "ETK-2026-1147",
  "cve_id": "CVE-2026-93943",
  "display_id": "CVE-2026-93943",
  "ghsa_id": "GHSA-x739-mm79-x5pj",
  "euvd_id": "EUVD-2026-96187",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in Convex",
  "summary": "Convex versions through 1.16.0 are affected by unsafe handling of serialized data. An attacker may be able to trigger object injection where they can supply data processed by the vulnerable deserialization path; the available evidence does not identify further preconditions.",
  "mitigation": "Restrict or disable untrusted access to any Convex functionality that accepts serialized input, and isolate affected deployments from untrusted users where possible. No fixed version is recorded; monitor for a vendor-supported update and apply it promptly.",
  "vendor": "ThemeREX Group",
  "product": "Convex",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.16.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "convex",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0031,
  "epss_percentile": 0.2283,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 29.250311683333333,
  "t0_at": "2026-10-10T07:00:38.253000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T08:33:44.839769+00:00",
      "days": 0.06465956908564814,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:00:38.253000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T07:00:38.253000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T07:00:38.253000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93943"
    }
  }
}