~ / search / GHSA-xpv2-8ppj-79hh

GHSA-xpv2-8ppj-79hh

Expression injection in AviatorScript

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41862

Packages

EcosystemPackageAffectedFixed in
Maven com.googlecode.aviator:aviator >= 5.2.1, <= 5.2.7 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).

References

External links from the advisory. They lead to third-party sites.