Expression injection in AviatorScript

CRÍTICO 9.8CVE-2021-41862 · GHSA-xpv2-8ppj-79hh · Published 02/10/2021 · updated 17/06/2026

En resumen

CVE-2021-41862 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a com.googlecode.aviator:aviator, aviatorscript (aviatorscript project).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.9%, mayor que el 80.2% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
com.googlecode.aviator:aviator Maven	`≥ 5.2.1, ≤ 5.2.7`	No fix yet
aviatorscript aviatorscript_project	`≥ 5.2.1`	No fix yet

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).

NVD description

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).

Running one of these products? Scan your site to see whether it exposes a vulnerable version.