posit vulnerabilities

Products

• workbench 2
• rstudio server 1

Latest posit CVEs

Newest publication first

1. CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

   Published 2026-11-06

   Medium·CVSS 4.7 EPSS 0.25%

   Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a differen...

2. CVE-2026-121881 Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

   Published 2026-11-06

   Medium·CVSS 5.7 EPSS 0.27%

   SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.