What is the CVSS score of CVE-2026-36418?

CVE-2026-36418 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of JimuReport are affected by CVE-2026-36418?

JimuReport 2.3.4 and earlier is vulnerable to unauthenticated remote code execution through the /jmreport/executeSelectApi endpoint, enabling attackers to achieve full server compromise without any…

How to fix or mitigate CVE-2026-36418?

Within 24 hours, isolate the /jmreport/executeSelectApi endpoint by restricting network access to JimuReport instances to trusted internal users only, and confirm a complete inventory of all JimuReport 2.3.4 and earlier installations across the organization. Within 7 days, implement Web Application Firewall rules to block requests to the vulnerable endpoint, review JimuReport access logs for suspicious activity, and conduct forensic analysis for indicators of exploitation. Within 30 days, monitor vendor advisories for a released patch and apply immediately when available; if no patch is released, complete migration to an alternative reporting platform.

JimuReport CVE-2026-36418

CRITICAL

Code Injection (CWE-94)

2026-06-17 mitre

RCE Code Injection N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable endpoint (PR:N/AC:L) yielding arbitrary code execution justifies full C/I/A:H; scope unchanged as impact stays within the application host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:34 vuln.today

CVE Published

Jun 17, 2026 - 00:00 cve.org

CRITICAL 9.1

CVE Published

Jun 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.

AnalysisAI

Remote code execution in JimuReport 2.3.4 and earlier lets attackers run arbitrary code by injecting AviatorScript expressions into the /jmreport/executeSelectApi endpoint, which forwards user input straight into the Aviator expression engine without validation. The CVSS vector marks it as network-reachable and unauthenticated (PR:N), giving remote attackers full server compromise. No public exploit is identified at time of analysis, though a third-party technical writeup exists; EPSS is low (0.47%) and it is not on the CISA KEV list.

Technical ContextAI

JimuReport is an open-source, low-code visual reporting and dashboard tool (part of the JeecgBoot ecosystem) written in Java. The flaw is a CWE-94 Code Injection: the /jmreport/executeSelectApi endpoint, used to run report data queries, passes attacker-controlled strings directly to Google AviatorScript - a lightweight expression evaluation engine embedded in JVM applications. Because Aviator can invoke Java methods and reflection when unrestricted, an unvalidated expression becomes a full code-execution primitive. The CPE string (cpe:2.3:a:n/a:n/a) is a placeholder ('n/a') and provides no authoritative vendor/product identification, so affected-product boundaries rest on the description alone.

RemediationAI

Upgrade to a JimuReport release later than 2.3.4 once the vendor publishes a fixed build; no vendor-released patch version is identified in the available data, so verify the current fixed release on the official JimuReport/JeecgBoot project before deployment. As compensating controls until patched, restrict network access to the /jmreport/executeSelectApi endpoint (and the broader /jmreport/ path) via reverse-proxy or WAF rules and require authentication in front of it - trade-off: this may break legitimate report execution for anonymous dashboards. Where the reporting feature is not needed, disable or block the executeSelectApi route entirely, and place the application behind a network segment not exposed to the internet to reduce untrusted reachability. Consult the VulDB advisory (https://vuldb.com/vuln/372072) and the technical writeup (https://github.com/Catherines77/code-au/blob/main/jimureport/aviator.md) for detection guidance.