EUVD-2026-40330
GHSA-87wr-qq84-hxhv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No attacker privileges required to craft and share a malicious project; developer execution yields full confidentiality and integrity impact on the workstation.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.13 (All versions), Mendix Studio Pro 10.14 (All versions), Mendix Studio Pro 10.15 (All versions), Mendix Studio Pro 10.16 (All versions), Mendix Studio Pro 10.17 (All versions), Mendix Studio Pro 10.18 (All versions), Mendix Studio Pro 10.19 (All versions), Mendix Studio Pro 10.20 (All versions), Mendix Studio Pro 10.21 (All versions), Mendix Studio Pro 10.22 (All versions), Mendix Studio Pro 10.23 (All versions), Mendix Studio Pro 10.24 (All versions < V10.24.21), Mendix Studio Pro 11.0 (All versions), Mendix Studio Pro 11.1 (All versions), Mendix Studio Pro 11.10 (All versions), Mendix Studio Pro 11.11 (All versions), Mendix Studio Pro 11.2 (All versions), Mendix Studio Pro 11.3 (All versions), Mendix Studio Pro 11.4 (All versions), Mendix Studio Pro 11.5 (All versions), Mendix Studio Pro 11.6 (All versions < V11.6.7), Mendix Studio Pro 11.7 (All versions), Mendix Studio Pro 11.8 (All versions), Mendix Studio Pro 11.9 (All versions). Affected versions of Mendix Studio Pro do not properly validate or sanitize project files processed during the build pipeline. This could allow an attacker who tricks a user into opening and running a specially crafted malicious project locally on their system to execute arbitrary code in the context of that user.
AnalysisAI
Code injection via malicious project files in Mendix Studio Pro 10.11 through 11.11 allows arbitrary code execution on a developer's workstation when a victim opens and runs a specially crafted project through the build pipeline. Siemens' own ProductCERT (SSA-779310) reported this flaw, classifying it under CWE-94, with patches available only for the 10.24 and 11.6 long-term support lines. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the breadth of affected versions - spanning the entire 10.x and 11.x release trees - means most active Mendix developer environments are exposed.
Technical ContextAI
Mendix Studio Pro is a low-code application development IDE published by Siemens used to design, build, and deploy enterprise applications. During the local build pipeline, the tool processes structured project files (models, configurations, scripts) without properly validating or sanitizing their content. CWE-94 (Improper Control of Generation of Code / Code Injection) is the root cause - the build pipeline executes or evaluates attacker-controlled content embedded in a project file as if it were trusted code. This is analogous to IDE-level supply chain attacks seen in other development environments (e.g., malicious VS Code extensions or poisoned CMakeLists.txt). Affected CPEs span all minor releases from cpe:2.3:a:siemens:mendix_studio_pro_10.11 through 10.24 (pre-V10.24.21) and 11.0 through 11.11 (pre-V11.6.7 for the 11.6 branch; all versions for all other 11.x minors).
RemediationAI
Upgrade to Mendix Studio Pro V10.24.21 or later if on the 10.x release track, or to V11.6.7 or later if on the 11.6 branch, as per the Siemens ProductCERT advisory SSA-779310 (https://cert-portal.siemens.com/productcert/html/ssa-779310.html). Developers on version lines 10.11-10.23 or 11.0-11.5 and 11.7-11.11 should migrate to one of the patched branches, as no in-place fix exists for those minor versions. As a compensating control while migration is in progress, restrict developer workstations to only open Mendix project files from trusted, organizationally controlled repositories - do not open unsolicited or external projects, particularly those shared via email, chat, or untrusted third-party links. Code-review project file diffs before executing builds on newly received projects. Note that these workarounds require process discipline and do not eliminate the technical vulnerability; they reduce exposure through behavior change only.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today