CVE-2025-27107

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-27107

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27107.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-27107

Aliases

GHSA-2v5x-4823-hq77

Published

2025-03-13T16:55:06.914Z

Modified

2026-08-12T03:51:38.300623061Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P CVSS Calculator

Summary

Integrated Scripting vulnerable to arbitrary code execution via Java reflection

Details

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from java.lang.Runtime.exec, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27107.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.21.4-1.0.9-254"
                }
            ]
        }
    ],
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-74"
    ]
}

References

Affected packages

Git / github.com/cyclopsmc/integratedscripting

Affected ranges

Type

GIT

Repo

https://github.com/cyclopsmc/integratedscripting

Events

Introduced

Fixed

cc5d6be6b6cd4024a2bf732947ea3655a1f8d0cb

Fixed

28c1bdd0decd638b117fd1b071aa6407095866e2

Fixed

ce8e9bb3758d4121db37486e6cf18838aa8bb987

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.21.1-1.0.17"
        },
        {
            "fixed": "1.20.1-1.0.13"
        },
        {
            "fixed": "1.19.2-1.0.10"
        }
    ]
}

Affected versions

1.*

1.19.2-1.0.0

1.19.2-1.0.1

1.19.2-1.0.2

1.19.2-1.0.3

1.19.2-1.0.4

1.19.2-1.0.5

1.19.2-1.0.6

1.19.2-1.0.7

1.19.2-1.0.8

1.19.2-1.0.9

1.20.1-1.0.0

1.20.1-1.0.1

1.20.1-1.0.10

1.20.1-1.0.11

1.20.1-1.0.12

1.20.1-1.0.2

1.20.1-1.0.3

1.20.1-1.0.4

1.20.1-1.0.5

1.20.1-1.0.6

1.20.1-1.0.7

1.20.1-1.0.8

1.20.1-1.0.9

1.20.4-1.0.1

1.20.4-1.0.2

1.20.4-1.0.3

1.21-1.0.3

1.21-1.0.4

1.21-1.0.5

1.21.1-1.0.10

1.21.1-1.0.11

1.21.1-1.0.12

1.21.1-1.0.13

1.21.1-1.0.14

1.21.1-1.0.15

1.21.1-1.0.16

1.21.1-1.0.6

1.21.1-1.0.7

1.21.1-1.0.8

1.21.1-1.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27107.json"