Spotted what might be an issue in maestro-common/gradle.lockfile around line 33.
The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.
Something like this might fix it:
```diff
--- a/maestro-common/gradle.lockfile
@@
-commons-beanutils:commons-beanutils:1.9.4
+commons-beanutils:commons-beanutils:1.11.0
```
For reference: rule CVE-2025-48734. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
maestro-common/gradle.lockfilearound line 33.The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE-2025-48734. An attacker can supply crafted property paths to PropertyUtilsBean.getProperty() and retrieve the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a high‑severity improper access control issue. Upgrading to version 1.11.0 (or later) disables the unsafe "declaredClass" introspection by default, eliminating the attack vector.
Something like this might fix it:
For reference: rule
CVE-2025-48734. Rated high.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.