An attacker can create a malicious .omv (jamovi) document containing a script payload in a column name.
The jamovi 0.9.5.5 exploit serves as a reminder that even specialized academic tools must be kept up to date. While jamovi is an excellent tool for open science, using outdated versions exposes users to unnecessary risks. By staying informed and maintaining updated software, researchers can focus on their data without worrying about security breaches.
The jamovi 0955 exploit incident led to significant changes in the way statistical software is developed and tested. The experience also sparked a new research interest for Rachel, as she began to explore the intersection of statistics, cybersecurity, and data analysis. Her work on the Nightshade exploit became a seminal paper in her field, and she continued to collaborate with experts worldwide to prevent similar incidents in the future.
To protect against this exploit, users and administrators should take the following steps:
: Never run a jamovi instance on a public server without firewall protections or password authentication. 🔍 Related Vulnerabilities Description CVE-2021-28079
: The exploit is activated when a victim opens the specially crafted file. Because jamovi renders parts of its UI as a web page, the malicious script executes in the user's local browser context. Data Theft