{"action":"Upgrade org.apache.nifi:nifi-asana-processors to 2.7.0 or later.","affected":[{"fixed":"2.7.0","introduced":"1.20.0"}],"component":"org.apache.nifi:nifi-asana-processors","cve_ids":["CVE-2025-66524"],"ecosystem":"Maven","epss":0.00594,"exploited":false,"fixed_versions":["2.7.0"],"ghsa_id":"GHSA-v4p2-2w39-mhrj","id":"tcs_01M5N9D70N7ZYJ2215FSWEKJF8","modified_at":"2025-12-23T15:56:41.802470Z","published_at":"2025-12-19T12:31:24Z","references":["https://osv.dev/vulnerability/GHSA-v4p2-2w39-mhrj","https://nvd.nist.gov/vuln/detail/CVE-2025-66524","https://github.com/apache/nifi/commit/1c081c15544b8459d69daaae2056f0f433cafce6","https://github.com/apache/nifi","https://lists.apache.org/thread/k9h004ydjg7opdvxr0nfywtzf33z60d7","http://www.openwall.com/lists/oss-security/2025/12/18/2"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-v4p2-2w39-mhrj","url":"https://osv.dev/vulnerability/GHSA-v4p2-2w39-mhrj"},{"source":"nvd","source_id":"CVE-2025-66524","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66524"}],"summary":"Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization"}