CVE-2026-75411: JeecgBoot vulnerability
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
Affected Software
Event History
Frequently Asked Questions
What component must be exposed for this issue to be exploitable?
The affected functionality is the CodeNode component in JeecgBoot's AI Flow module. Exploitation depends on reaching a CodeNode path that executes Groovy scripts.
What enables the blacklist bypass?
Groovy's dynamic capabilities allow dangerous calls to be assembled through string concatenation and invoked through reflection. This bypasses the SecurityCheck class's blacklist-based filtering.
Does the available information identify a fixed version or workaround?
No fixed version, configuration mitigation, or workaround is provided in the available data. The identified affected version is JeecgBoot v3.9.2.