{"action":"Upgrade io.openremote:openremote-manager to 1.22.0 or later.","affected":[{"fixed":"1.22.0","introduced":"0"}],"component":"io.openremote:openremote-manager","cve_ids":["CVE-2026-39842"],"ecosystem":"Maven","epss":0.00924,"exploited":false,"fixed_versions":["1.22.0"],"ghsa_id":"GHSA-7mqr-33rv-p3mp","id":"tcs_01M5N8JQDCP9T21QXTEEV3558F","modified_at":"2026-05-05T16:03:44.111146Z","published_at":"2026-04-14T22:31:36Z","references":["https://osv.dev/vulnerability/GHSA-7mqr-33rv-p3mp","https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp","https://nvd.nist.gov/vuln/detail/CVE-2026-39842","https://github.com/openremote/openremote","https://github.com/openremote/openremote/releases/tag/1.22.0"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-7mqr-33rv-p3mp","url":"https://osv.dev/vulnerability/GHSA-7mqr-33rv-p3mp"}],"summary":"Expression Injection in OpenRemote"}