CVE-2026-25809 Details

A code execution vulnerability exists in PlaciPy version 1.0.0, a placement management system for educational institutions. The issue arises because the code evaluation endpoint does not verify the assessment lifecycle state before execution. There are no checks to ensure that the assessment has started, is not expired, or that the submission window is currently open. This flaw allows for unauthorized code execution, bypassing assessment policies and timing controls, which could lead to academic integrity violations.

To address this vulnerability, assessments should be validated for their active state before code execution is allowed. This includes checking the assessment's start and end times and rejecting executions outside the permitted windows. It is also recommended to centralize the enforcement of assessment states and log any rejected execution attempts.