A vulnerability was detected in wren-lang wren up to 0.4... · CVE-2026-3385 · GitHub Advisory Database · GitHub

A vulnerability was detected in wren-lang wren up to 0.4...

Moderate severity Unreviewed Published Mar 1, 2026 to the GitHub Advisory Database • Updated Mar 10, 2026

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

Published by the National Vulnerability Database

Mar 1, 2026

Published to the GitHub Advisory Database Mar 1, 2026

Last updated Mar 10, 2026

Weaknesses

CWE-404

Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use. Learn more on MITRE.

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Learn more on MITRE.