judge0 — Vulnerabilities & Security Advisories 3

Judge0 is an online code execution platform designed for compiling and running code in multiple programming languages. Historically, it has been vulnerable to remote code execution (RCE) through sandbox escapes, cross-site scripting (XSS) in its web interface, and privilege escalation flaws that allowed unauthorized access to system resources. These vulnerabilities stem from improper input validation and insufficient sandbox isolation. While no major public incidents have been widely reported, the three CVEs highlight persistent security challenges in code execution environments, particularly around sandbox integrity and user input handling. The platform remains popular despite these risks, underscoring the ongoing tension between functionality and security in online code execution services.