Executive brief
Titra is an open-source time-tracking application used to log and manage project work hours. An authenticated administrator can inject malicious JavaScript code into time entry rules, which the application then executes without sanitization, allowing complete control over the server. This could lead to data theft, service disruption, or use of the server for further attacks.
Technical details
The vulnerability is a remote code execution (RCE) flaw caused by improper input validation in the timeEntryRule parameter. An authenticated admin user can modify the timeEntryRule database field with arbitrary JavaScript code. This unsanitized input is passed directly to a NodeVM execution context without validation or escaping, allowing the code to execute with server privileges. The attack requires admin-level authentication but no network bypass; the fix was released in version 0.99.49 by adding input sanitization and Docker privilege restrictions.
Affected products
- Titra Titra prior to 0.99.49
Timeline
- 2025-12-31: disclosed
- 2025-12-31: patched: Version 0.99.49 released with sanitization fix