EUVD-2026-66747
GHSA-8mm6-mrr9-hg9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess AI Flow designer
-
DeliveryCraft obfuscated Groovy in CodeNode
-
ExploitBypass SecurityCheck via concat/reflection
-
ExecutionExecute arbitrary OS commands
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the ability to submit a Groovy script to the AI Flow module's CodeNode component - i.e. access to the workflow/flow designer where a CodeNode can be created or edited and executed. Exploitation limits: this is not a passive network service but a scripting feature, so the attacker needs a path to invoke CodeNode execution, which in typical JeecgBoot deployments means an authenticated account with AI Flow / designer privileges (the input's PR:N is not corroborated by the description and should be verified). No user interaction by a victim is needed, no non-default enablement is described beyond the AI Flow module being present, and the target is JeecgBoot v3.9.2. Confirm whether the AI Flow endpoint is reachable pre-authentication in your build before treating it as unauthenticated. |
| Impact | The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which would imply trivial unauthenticated internet-facing RCE. That severity is worth scrutinizing: the vulnerable capability is a workflow-designer feature (submitting/executing Groovy in a CodeNode), which in JeecgBoot deployments is normally reached by an authenticated user with access to the AI Flow builder - so PR:N is likely overstated and PR:L is more realistic. This is a genuine RCE if that access is available, but the real-world priority is tempered by EPSS 0.22% (13th percentile, low), no KEV listing, and no public PoC. The signals are consistent: no evidence of active exploitation and low predicted exploitation probability, so treat this as a patch-soon RCE rather than an emergency, especially where the JeecgBoot admin/designer interface is not exposed to untrusted networks. Verify the authentication prerequisite against the vendor issue before assuming unauthenticated reach. |
| Exploit ScenarioDerived | An attacker with access to the JeecgBoot AI Flow designer creates or edits a workflow containing a CodeNode, then supplies a Groovy script that reconstructs blocked classes/methods through string concatenation and reflection (e.g. reflectively resolving Runtime.exec). When the flow node executes, the script bypasses SecurityCheck and runs arbitrary OS commands as the JeecgBoot service account. No public PoC is currently available, and given AC:L the payload construction is straightforward for anyone able to reach the CodeNode. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Remote command execution in JeecgBoot v3.9.2 lets attackers run arbitrary OS commands through the AI Flow module's CodeNode component, which executes user-supplied Groovy scripts. The SecurityCheck class enforces a blacklist to block dangerous calls, but Groovy's dynamic dispatch allows the blacklist to be fully bypassed via string concatenation and reflection, yielding full code execution. No public exploit is identified at time of analysis, and EPSS is low (0.22%, 13th percentile), consistent with a newly disclosed issue rather than mass exploitation.
RemediationAI
No vendor-released patch version is identified at time of analysis; the only tracking artifact is upstream GitHub issue #9691 (https://github.com/jeecgboot/JeecgBoot/issues/9691), so monitor it for a fixed release and upgrade to that version once published. As compensating controls until a fix ships: disable or remove the AI Flow CodeNode/Groovy execution capability if your deployment does not require it (removes the attack surface but breaks any workflows relying on scripting); restrict access to the AI Flow designer and admin endpoints to a minimal set of trusted, authenticated operators via role/permission tightening and network ACLs (reduces reachability but does not stop a malicious insider); and place the platform behind an authenticated reverse proxy / VPN so the designer UI is never internet-exposed. Do not rely on the SecurityCheck blacklist itself, since the vulnerability is precisely its bypass. Verify all changes against the vendor issue before relaxing them.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JeecgBoot is an open-source Java/Spring Boot low-code development platform (vendor jeecgboot). The affected surface is the AI Flow module's CodeNode, which embeds a Groovy scripting engine so workflow authors can execute custom logic. The intended control is the SecurityCheck class, a blacklist-based sandbox that intercepts known-dangerous method/class references. This is a classic CWE-94 (Code Injection) failure: blacklisting a dynamic JVM scripting language is fundamentally unsound because Groovy resolves method and class names at runtime, so an attacker reconstructs forbidden identifiers (e.g. 'Run'+'time', reflective Class.forName / getMethod invocation) that never match static blacklist entries. Once a benign-looking script slips past the filter, it runs with the full privileges of the JeecgBoot JVM process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable RCE with straightforward payload (AC:L), but reaching the AI Flow CodeNode designer realistically requires an authenticated account, so PR:L rather than the input's PR:N; full host impact gives C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
Executive ViewAI
JeecgBoot v3.9.2 deployments are vulnerable to remote code execution attacks enabling complete system compromise and unauthorized data access. Organizations running this platform face immediate risk of business disruption, data theft, and infrastructure takeover with no currently available vendor patch. Swift implementation of interim security controls is critical.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) disable AI Flow CodeNode feature via configuration; (2) restrict network access to affected systems through firewall rules or network segmentation; (3) implement application-level monitoring for unusual script execution patterns; (4) evaluate and plan migration to alternative platforms pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB