[CVE-2026-36418] JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling…

Descripción técnica

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Deferred

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Debilidades (CWE)

CWE-94

Fuente oficial

Publicado en NIST NVD.