VULNERABILITY INTELLIGENCE
CVE-2022-24881
CVSS score8.8 HIGH
EPSS probability3.20%
CISA KEVNot currently listed
Published2022-04-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.
Weakness classification
- security-advisories@github.com: CWE-94
- nvd@nist.gov: CWE-20
Primary references
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Issue Tracking, Patch, Third Party Advisory
- security-advisories@github.com — Exploit, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory