critical9.8
CVE-2025-26074
Conductor vulnerable to OS command injection through unrestricted access to Java classes
Impact
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.conductoross:conductor-core | < 3.21.13 | 3.21.13 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/conductor-oss/conductor
- https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java
- https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb
- https://github.com/advisories/GHSA-8gqp-hr9g-pg62
- https://nvd.nist.gov/vuln/detail/CVE-2025-26074
- https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b