{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.5"}],"component":"com.bstek.uflo:uflo-core","cve_ids":["CVE-2022-25894"],"ecosystem":"Maven","epss":0.02575,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8m9f-c5p9-wqch","id":"tcs_01M5N8N1AQPTMG4JAJB327ZSK2","modified_at":"2025-04-01T22:59:58.329089Z","published_at":"2023-01-26T21:30:25Z","references":["https://osv.dev/vulnerability/GHSA-8m9f-c5p9-wqch","https://nvd.nist.gov/vuln/detail/CVE-2022-25894","https://fmyyy1.github.io/2022/10/23/uflo2rce","https://github.com/youseries/uflo/blob/b3e198bc6523e5a6ba69edd84ba10e05a3b78726/uflo-core/src/main/java/com/bstek/uflo/expr/impl/ExpressionContextImpl.java#L126","https://security.snyk.io/vuln/SNYK-JAVA-COMBSTEKUFLO-3091112"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-8m9f-c5p9-wqch","url":"https://osv.dev/vulnerability/GHSA-8m9f-c5p9-wqch"}],"summary":"Remote Code Execution in com.bstek.uflo:uflo-core"}