PT-2026-82304 · Unknown · Jeecg-Boot
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
JeecgBoot version 3.9.2
Description
Remote command execution is possible in the CodeNode component of the AI Flow module, which supports Groovy script execution. The
SecurityCheck class uses a blacklist to intercept dangerous calls; however, this mechanism can be bypassed using string concatenation and reflection due to the dynamic nature of Groovy.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jeecg-Boot