deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6vfr-p2hx-6v32
Package: org.apache.linkis:linkis-metadata (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 1.0.0, < 1.8.0
Patched in: 1.8.0

Summary: Apache Linkis: Password Exposure

Details:
When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode failed", e). If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will be left in the log files when decoding fails, resulting in information leakage.


Affected Scope
Component: Sensitive fields in hive-site.xml (e.g., javax.jdo.option.ConnectionPassword) or other fields encoded in Base64.
Version: Apache Linkis 1.0.0 – 1.7.0


Trigger Conditions
The value of the configuration item is an invalid Base64 string.
Log files are readable by users other than hive-site.xml administrators.


Severity: Low
The probability of Base64 decoding failure is low.
The leakage is only triggered when logs at the Error level are exposed.

Remediation
Apache Linkis 1.8.0 and later versions have replaced the log with desensitized content.
logger.error("URL decode failed: {}", e.getMessage());   // 不再输出 str


Users are recommended to upgrade to version 1.8.0, which fixes the issue.
GitHub Security Advisory: GHSA-c399-q49h-qwc8
Package: org.apache.linkis:linkis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-177: Improper Handling of URL Encoding (Hex Encoding)
Vulnerable versions: >= 1.3.0, < 1.8.0
Patched in: 1.8.0

Summary: Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass

Details:
A vulnerability in Apache Linkis.

Problem Description

When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger a vulnerability that allows unauthorized access to system files via JDBC parameters.

Scope of Impact


This issue affects Apache Linkis: from 1.3.0 through 1.7.0.

Severity level


moderate
Solution
Continuously check if the connection information contains the "%" character; if it does, perform URL decoding.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.




More questions about this vulnerability can be discussed here:  https://lists.apache.org/list?dev@linkis.apache.org:2025-9:cve
GitHub Security Advisory: GHSA-vhcx-7rpg-hp39
Package: net.risesoft:risenet-y9boot-support-platform-service (MAVEN)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 9.7.0-M5
Patched in: unpatched

Summary: risesoft-y9 Digital-Infrastructure has a SQL injection vulnerability

Details:
A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/util/Y9PlatformUtil.java of the component REST Authenticate Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
GitHub Security Advisory: GHSA-hrvf-g648-rf3m
Package: net.sourceforge.plantuml:plantuml (MAVEN)
Severity: LOW (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.2026.0
Patched in: 1.2026.0

Summary: PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams

Details:
Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaScript into generated SVG output, leading to arbitrary script execution in the context of applications that render the SVG.
GitHub Security Advisory: GHSA-cphf-4846-3xx9
Package: io.vertx:vertx-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 5.0.0.CR1, < 5.0.7
Patched in: 5.0.7

Summary: Vert.x Web static handler component cache can be manipulated to deny the access to static files

Details:
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.


The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web):  https://github.com/eclipse-vertx/vert.x/pull/5895 



Steps to reproduce
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html

Mitgation
Disabling Static Handler cache fixes the issue.



StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
GitHub Security Advisory: GHSA-fccg-7w3p-w66f
Package: nu.validator:validator (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 26.1.11
Patched in: unpatched

Summary: Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability

Details:
Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and 127.0.0.1, these controls can be bypassed using DNS rebinding techniques or domains that resolve to loopback addresses.This issue affects The Nu Html Checker (vnu): latest (commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd).
GitHub Security Advisory: GHSA-v897-pv23-r8cw
Package: org.keycloak:keycloak-quarkus-server (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 26.2.5
Patched in: unpatched

Summary: Keycloak has an improper input validation vulnerability

Details:
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.
GitHub Security Advisory: GHSA-cphf-4846-3xx9
Package: io.vertx:vertx-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 4.5.24
Patched in: 4.5.24

Summary: Vert.x Web static handler component cache can be manipulated to deny the access to static files

Details:
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.


The issue comes from an improper implementation of the C. rule of section 5.2.4 of RFC3986 and is fixed in Vert.x Core component (used by Vert.x Web):  https://github.com/eclipse-vertx/vert.x/pull/5895 



Steps to reproduce
Given a file served by the static handler, craft an URI that introduces a string like bar%2F..%2F after the last / char to deny the access to the URI with an HTTP 404 response. For example https://example.com/foo/index.html can be denied with https://example.com/foo/bar%2F..%2Findex.html

Mitgation
Disabling Static Handler cache fixes the issue.



StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
GitHub Security Advisory: GHSA-4jrw-64vr-7g8m
Package: org.apache.camel:camel-neo4j (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: >= 4.15.0, < 4.17.0
Patched in: 4.17.0

Summary: Apache Camel camel-neo4j component is vulnerable to cypher injection

Details:
Cypher Injection vulnerability in Apache Camel camel-neo4j component.

This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0

Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
GitHub Security Advisory: GHSA-4jrw-64vr-7g8m
Package: org.apache.camel:camel-neo4j (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: >= 4.14.0, < 4.14.3
Patched in: 4.14.3

Summary: Apache Camel camel-neo4j component is vulnerable to cypher injection

Details:
Cypher Injection vulnerability in Apache Camel camel-neo4j component.

This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0

Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
GitHub Security Advisory: GHSA-4jrw-64vr-7g8m
Package: org.apache.camel:camel-neo4j (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-943: Improper Neutralization of Special Elements in Data Query Logic
Vulnerable versions: >= 4.10.0, < 4.10.8
Patched in: 4.10.8

Summary: Apache Camel camel-neo4j component is vulnerable to cypher injection

Details:
Cypher Injection vulnerability in Apache Camel camel-neo4j component.

This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, from 4.15.0 before 4.17.0

Users are recommended to upgrade to version 4.10.8 for 4.10.x LTS and 4.14.3 for 4.14.x LTS and 4.17.0.
GitHub Security Advisory: GHSA-vrpq-qp53-qv56
Package: org.eclipse.jgit:org.eclipse.jgit (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 6.0.0[PII_REDACTED]47-m1, < 6.0.0[PII_REDACTED]00-r
Patched in: 6.0.0[PII_REDACTED]00-r

Summary: Eclipse JGit XML External Entity (XXE) Vulnerability

Details:
In Eclipse JGit versions 7.2.0[PII_REDACTED]40-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
GitHub Security Advisory: GHSA-qcfc-hmrc-59x7
Package: org.apache.struts.xwork:xwork-core (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-112: Missing XML Validation, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.2.1, < 6.1.1
Patched in: unpatched

Summary: Apache Struts 2 is Missing XML Validation

Details:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-qcfc-hmrc-59x7
Package: com.opensymphony:xwork (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-112: Missing XML Validation, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.0.0, < 2.2.1
Patched in: unpatched

Summary: Apache Struts 2 is Missing XML Validation

Details:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-qcfc-hmrc-59x7
Package: org.apache.struts:struts2-core (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-112: Missing XML Validation, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 6.0.0, < 6.1.1
Patched in: 6.1.1

Summary: Apache Struts 2 is Missing XML Validation

Details:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-qcfc-hmrc-59x7
Package: org.apache.struts:struts2-core (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-112: Missing XML Validation, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.5.0, <= 2.5.33
Patched in: unpatched

Summary: Apache Struts 2 is Missing XML Validation

Details:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-qcfc-hmrc-59x7
Package: org.apache.struts:struts2-core (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-112: Missing XML Validation, CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.0.0, <= 2.3.37
Patched in: unpatched

Summary: Apache Struts 2 is Missing XML Validation

Details:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.

This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.

Users are recommended to upgrade to version 6.1.1, which fixes the issue.
GitHub Security Advisory: GHSA-gxp5-mv27-vjcj
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-287: Improper Authentication, CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis's AES CBC Mode is Without Authentication

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L682-L684

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L720-L722

`AES/CBC/PKCS5Padding` lacks authentication, making it vulnerable to padding oracle attacks and ciphertext manipulation.

### Impact

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.

Unlikely to matter due to the design of how AES-256-CBC is used in conjunction with RSA and SHA-256 checksum within Jervis.

Jervis uses RSA to encrypt AES keys and a SHA-256 checksum of the encrypted data in local-only storage inaccessible from the web.  After asymmetric decryption and before symmetric decryption, a SHA-256 checksum is performed on the metadata and encrypted data. All encrypted data is discarded if the checksum does not match without attempting to decrypt since the encrypted data is assumed invalid.  The data stored is GitHub App authentication tokens which will expire within one hour.

### Patches

Jervis patch will migrate from `AES/CBC/PKCS5Padding` to `AES/GCM/NoPadding`.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [Padding Oracle Attacks](https://en.wikipedia.org/wiki/Padding_oracle_attack)
GitHub Security Advisory: GHSA-5pq9-5mpr-jj85
Package: net.gleske:jervis (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis Has a JWT Algorithm Confusion Vulnerability

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L244-L249

The code doesn't validate that the JWT header specifies `"alg":"RS256"`.

### Impact

Depending on the broader system, this could allow JWT forgery.

Internally this severity is low since JWT is only intended to interface with GitHub.  External users should consider severity moderate.

### Patches

Jervis patch will explicitly verify the algorithm in the header matches expectations and further verify the JWT structure.

Upgrade to Jervis 2.2.

### Workarounds

External users should consider using an alternate JWT library or upgrade.

### References

- [RFC 7518: JSON Web Algorithms](https://datatracker.ietf.org/doc/html/rfc7518)
GitHub Security Advisory: GHSA-c9q6-g3hr-8gww
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 5.9)
CWE: CWE-330: Use of Insufficiently Random Values
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis Has Weak Random for Timing Attack Mitigation

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L593-L594

Uses `java.util.Random()` which is not cryptographically secure.

### Impact

If an attacker can predict the random delays, they may still be able to perform timing attacks.

### Patches

Jervis will use `SecureRandom` for timing randomization.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
GitHub Security Advisory: GHSA-36h5-vrq6-pp34
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-326: Inadequate Encryption Strength
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis's Salt for PBKDF2 derived from password

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L869-L870

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L894-L895

The salt is derived from sha256Sum(passphrase).  Two encryption operations with the same password will have the same derived key.

### Impact

Pre-computation attacks.

Severity is considered low for internal uses of this library and high for consumers of this library.

### Patches

Jervis will generate a random salt for each password and store it alongside the ciphertext.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [NIST SP 800-132: Password-Based Key Derivation](https://csrc.nist.gov/publications/detail/sp/800-132/final)
GitHub Security Advisory: GHSA-67rj-pjg6-pq59
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis Has a SHA-256 Hex String Padding Bug

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L622-L626

`padLeft(32, '0')` should be `padLeft(64, '0')`. SHA-256 produces 32 bytes = 64 hex characters.

### Impact

* Inconsistent hash lengths when leading bytes are zero
* Comparison failures for hashes with leading zeros
* Potential security issues in hash-based comparisons
* Could cause subtle bugs in systems relying on consistent hash lengths

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

### Patches

Upgrade to Jervis 2.2.

### Workarounds

Use an alternate SHA-256 hash function or upgrade.
GitHub Security Advisory: GHSA-crxp-chh4-9ghp
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis has Deterministic AES IV Derivation from Passphrase

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L866-L874

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L891-L900

Same passphrase + same plaintext = same ciphertext (IV reuse)

### Impact

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered high.

Significant reduction in the security of the encryption scheme. Pattern analysis becomes possible.

### Patches

Random IV will be generated and prepended to the ciphertext.

Upgrade to Jervis 2.2.

### Workarounds

None
GitHub Security Advisory: GHSA-mqw7-c5gg-xq97
Package: net.gleske:jervis (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 2.2
Patched in: 2.2

Summary: Jervis Has a RSA PKCS#1 Padding Vulnerability

Details:
### Vulnerability

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L463-L465

https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovy#L495-L497

Uses `PKCS1Encoding` which is vulnerable to Bleichenbacher padding oracle attacks. Modern systems should use OAEP (Optimal Asymmetric Encryption Padding).

### Impact

Severity is considered low for internal uses of this library but if there's any consumer using these methods directly then this is considered critical.

An attacker with access to a decryption oracle (e.g., timing differences or error messages) could potentially decrypt ciphertext without knowing the private key.

Jervis uses RSA to encrypt AES keys in local-only storage inaccessible from the web.  The data stored is GitHub App authentication tokens which will expire within one hour or less.

### Patches

Jervis patch will migrate from `PKCS1Encoding` to `OAEPEncoding`.

Upgrade to Jervis 2.2.

### Workarounds

None

### References

- [Bleichenbacher's Attack on PKCS#1](https://en.wikipedia.org/wiki/Adaptive_chosen-ciphertext_attack)
GitHub Security Advisory: GHSA-jm7w-5684-pvh8
Package: com.alibaba:fastjson (MAVEN)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 1.2.48
Patched in: 1.2.48

Summary: FASTJSON Includes Functionality from Untrusted Control Sphere 

Details:
Fastjson before 1.2.48 mishandles autoType because, when an `@type` key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.