-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.xmlgraphics:batik | maven | < 1.16 | 1.16 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from inadequate class filtering in the Rhino JavaScript engine integration. The fix commits (52f7a1a, 401aa85) show the vulnerable method originally allowed access to Java classes starting with 'java.' unless explicitly blocked, while the patched version added 'org.*' restrictions and tightened the allowlist. The test case in eada57c explicitly checks for blocking java.lang.Runtime access, confirming this was an attack vector. The CVE description of arbitrary Java execution via SVG JavaScript aligns with this class permission bypass mechanism.
Ongoing coverage of React2Shell