CVE-2026-75411CWE-94code-injection

CVE-2026-75411

Critical · published August 27, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
65.9
In the wild
Unconfirmed
What it is

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01121 · 65.9th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-27T01:16Z
References (2)
https://github.com/jeecgboot/JeecgBoot/issues/9691 · [email protected]https://github.com/jeecgboot/JeecgBoot/issues/9691 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    JeecgBoot v3.9.2 is vulnerable to Remote command execution
    cvelistv5