Junjie Li

**Name of the Vulnerable Software and Affected Versions** Apache Gravitino versions prior to 1.2.1 **Description** Unauthenticated callers can execute arbitrary Java code on the server by providing a malicious H2 JDBC URL through the `testConnection` API. This is achieved by leveraging the `INIT` parameter of the H2 database. This issue specifically occurs when using H2, which is primarily utilized for local development and testing. **Recommendations** Upgrade to version 1.2.1.