{"api_version":"1","generated_at":"2026-07-24T03:31:27+00:00","cve":"CVE-2022-24881","urls":{"html":"https://cve.report/CVE-2022-24881","api":"https://cve.report/api/cve/CVE-2022-24881.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24881","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24881"},"summary":{"title":"CVE-2022-24881","description":"Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-04-26 16:15:00","updated_at":"2022-05-06 13:14:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://github.com/ballcat-projects/ballcat-codegen/commit/84a7cb38daf0295b93aba21d562ec627e4eb463b","name":"https://github.com/ballcat-projects/ballcat-codegen/commit/84a7cb38daf0295b93aba21d562ec627e4eb463b","refsource":"MISC","tags":[],"title":":lock: 修改模板引擎的默认安全策略，以防止RCE · ballcat-projects/ballcat-codegen@84a7cb3 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/ballcat-projects/ballcat-codegen/security/advisories/GHSA-fv3m-xhqw-9m79","name":"https://github.com/ballcat-projects/ballcat-codegen/security/advisories/GHSA-fv3m-xhqw-9m79","refsource":"CONFIRM","tags":[],"title":"ballcat-codegen exists for template engine remote code execution injection · Advisory · ballcat-projects/ballcat-codegen · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/ballcat-projects/ballcat-codegen/issues/5","name":"https://github.com/ballcat-projects/ballcat-codegen/issues/5","refsource":"MISC","tags":[],"title":"ballcat-codegen template engine injection RCE · Issue #5 · ballcat-projects/ballcat-codegen · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24881","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24881","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24881","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ballcat","cpe5":"codegen","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-24881","STATE":"PUBLIC","TITLE":"Command Injection in Ballcat Codegen"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"ballcat-codegen","version":{"version_data":[{"version_value":"< 1.0.0.beta.2"}]}}]},"vendor_name":"ballcat-projects"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}]},"references":{"reference_data":[{"name":"https://github.com/ballcat-projects/ballcat-codegen/security/advisories/GHSA-fv3m-xhqw-9m79","refsource":"CONFIRM","url":"https://github.com/ballcat-projects/ballcat-codegen/security/advisories/GHSA-fv3m-xhqw-9m79"},{"name":"https://github.com/ballcat-projects/ballcat-codegen/issues/5","refsource":"MISC","url":"https://github.com/ballcat-projects/ballcat-codegen/issues/5"},{"name":"https://github.com/ballcat-projects/ballcat-codegen/commit/84a7cb38daf0295b93aba21d562ec627e4eb463b","refsource":"MISC","url":"https://github.com/ballcat-projects/ballcat-codegen/commit/84a7cb38daf0295b93aba21d562ec627e4eb463b"}]},"source":{"advisory":"GHSA-fv3m-xhqw-9m79","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-04-26 16:15:00","lastModifiedDate":"2022-05-06 13:14:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ballcat:codegen:*:*:*:*:*:*:*:*","versionEndExcluding":"1.0.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24881","Ordinal":"228271","Title":"CVE-2022-24881","CVE":"CVE-2022-24881","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24881","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}