GHSA-wpwf-v25w-54g3

Source

https://github.com/advisories/GHSA-wpwf-v25w-54g3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wpwf-v25w-54g3/GHSA-wpwf-v25w-54g3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wpwf-v25w-54g3

Aliases

CVE-2026-5739

Published

2026-04-07T21:32:40Z

Modified

2026-04-08T20:02:41.827270Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection

Details

A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-74"
    ],
    "nvd_published_at": "2026-04-07T20:16:34Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T19:52:44Z"
}

References

Affected packages

Maven / tech.powerjob:powerjob-server-starter

Package

Name: tech.powerjob:powerjob-server-starter; View open source insights on deps.dev
Purl: pkg:maven/tech.powerjob/powerjob-server-starter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1.0

Last affected

5.1.2

Affected versions

5.*

5.1.0

5.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-wpwf-v25w-54g3/GHSA-wpwf-v25w-54g3.json"