-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the script alert plugin. The description explicitly mentions remote command execution via script alert parameters, which strongly implies that the function responsible for executing scripts (likely executeScript) failed to sanitize user-controlled inputs. This would allow attackers to inject malicious commands through script parameters. The confidence is high because the CWE-20 alignment and RCE impact pattern match command injection vulnerabilities in script execution handlers, even without direct access to the patch diff.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler | maven | < 3.0.2 | 3.0.2 |
| org.apache.dolphinscheduler:dolphinscheduler | maven | = 3.1.0 | 3.1.1 |
Ongoing coverage of React2Shell