CLEANSTART-2026-GV33004

See a problem?

Import Source

https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GV33004.json

JSON Data

https://api.osv.dev/v1/vulns/CLEANSTART-2026-GV33004

Upstream

CVE-2026-41719

Published

2026-10-10T00:36:51Z

Modified

2026-10-10T01:00:10Z

Severity

6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator

Summary

SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Details

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.

References

Affected packages

CleanStart / apache-nifi

Package

Name: apache-nifi
Purl: pkg:apk/cleanstart/apache-nifi

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.5.0-r0

Database specific

source

"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GV33004.json"