| Package | Affected versions | Patched versions |
|---|---|---|
| hertzbeat | < 1.4.1 | 1.4.1 |
Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free