What is the CVSS score of CVE-2025-9121?

CVE-2025-9121 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Pentaho CDE are affected by CVE-2025-9121?

Deployments of Pentaho Data Integration and Analytics that include the Community Dashboard Editor (CDE) plugin can be compromised by an attacker using an ordinary low-privilege account, allowing…

How to fix or mitigate CVE-2025-9121?

Within 24 hours, inventory every Pentaho Data Integration and Analytics instance, identify which ones have the Community Dashboard Editor (CDE) plugin installed, and disable or remove that plugin wherever it is not operationally required, prioritizing any instance reachable from untrusted networks; simultaneously restrict network access to CDE endpoints and review low-privilege account inventories to remove or tightly scope accounts that could serve as a foothold. Within 7 days, upgrade affected deployments to the vendor-released patch 10.2.0.4, recognizing that all versions before 10.2.0.4, including the 9.3.0.x and 8.3.x branches, are impacted when CDE is present, and where an in-place upgrade to 10.2.0.4 is not immediately feasible, isolate the instance behind strict network segmentation and enhanced logging. Within 30 days, complete migration of any remaining legacy 8.3.x and 9.3.0.x instances, confirm no CDE deployment still accepts untrusted JSON deserialization input, monitor the vendor advisory channel for any backported fixes to the older branches, and add detection rules for anomalous JSON payloads and unexpected child-process activity originating from Pentaho components.

Pentaho CDE CVE-2025-9121

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-12-15 security.vulnerabilities@hitachivantara.com

Deserialization

8.8

CVSS 3.1 · Vendor: hitachivantara

Severity by source

Vendor (hitachivantara) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable JSON endpoint (AV:N/AC:L), a low-privilege account is needed (PR:L) with no interaction, and unconstrained deserialization yields code execution with full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hitachivantara).

CVSS VectorVendor: hitachivantara

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 19:46 vuln.today

CVE Published

Dec 15, 2025 - 23:15 cve.org

HIGH 8.8

DescriptionCVE.org

Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes and methods.

AnalysisAI

Remote code execution in the Pentaho Community Dashboard Editor (CDE) plugin can allow a low-privilege authenticated attacker to compromise affected Pentaho Data Integration and Analytics deployments through unsafe deserialization of untrusted JSON. Versions before 10.2.0.4, including 9.3.0.x and 8.3.x, are impacted when the CDE plugin is present; exploitation requires network access and a valid low-privilege account but no user interaction. No public exploit identified at time of analysis, and the vendor has released a fixed version at 10.2.0.4.

Technical ContextAI

The CDE plugin in Pentaho processes JSON input and deserializes it without constraining the parser to an allow-list of approved classes and methods, which is the root cause class CWE-502 (Deserialization of Untrusted Data). In practice, attacker-controlled JSON can influence which types are instantiated during deserialization, potentially enabling object injection and, depending on available gadget chains, code execution or other high-impact actions. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the vulnerable path is network reachable, requires low privileges, needs no user interaction, and can have high confidentiality, integrity, and availability impact. The affected component is the Community Dashboard Editor plugin deployed on Pentaho Data Integration and Analytics; no CPE strings were provided in the input, but the vendor advisory identifies versions before 10.2.0.4 as impacted, including the 9.3.0.x and 8.3.x lines.

Affected ProductsAI

Pentaho Data Integration and Analytics Community Dashboard Editor (CDE) plugin versions before 10.2.0.4 are affected, including 9.3.0.x and 8.3.x. The issue applies when the CDE plugin is deployed or enabled on the Pentaho instance; versions 10.2.0.4 and later contain the fix. No CPE identifiers were present in the provided data, but the vendor advisory is available at https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121.

RemediationAI

Upgrade the Pentaho Data Integration and Analytics Community Dashboard Editor plugin to version 10.2.0.4 or later, which is the vendor-released fix for CVE-2025-9121, and verify that all Pentaho instances with the CDE plugin deployed are updated. If immediate upgrade is not possible, restrict network access to the Pentaho CDE interface to trusted users, remove or disable the CDE plugin if it is not required, and minimize the number of low-privilege accounts that can reach the affected JSON-handling functionality; disabling CDE will remove its dashboard editing and consumption capabilities. Because the vector requires only low privileges, enforce least privilege, require strong authentication, and monitor for anomalous deserialization or post-exploitation behavior. Confirm remediation details and any vendor-specific guidance using the advisory at https://support.pentaho.com/hc/en-us/articles/41832536185613--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-4-Impacted-CVE-2025-9121.