CVE-2023-30856

eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

8.3 HighPublic exploit

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.35%Up 0.3 points since Apr 29, 2023

What each source reports

CVE List Score used 8.3

eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

Record: CVE-2023-30856
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-1385, CWE-346
Updated: 2026-11-02

EUVDEUVD-2023-35200 8.3

Record: EUVD-2023-35200
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Updated: 2026-11-03

NVD 8.3

Record: CVE-2023-30856
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-346, CWE-1385
Updated: 2026-11-02

OSV 8.3

eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

Record: CVE-2023-30856
CVSS 3.1: 8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness: CWE-1385, CWE-346
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	zpf2234/edex-afterlife	2026-11-01

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30856 is a high vulnerability (CVSS 8.3) in Edex-ui Project Edex-ui, published April 28, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.