Came across something in maestro-engine/gradle.lockfile around line 42 that looked worth flagging.
The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.
Something like this might fix it:
*** Begin Patch
*** Update File: maestro-engine/gradle.lockfile
@@
- "commons-beanutils:commons-beanutils:1.9.4"
+ "commons-beanutils:commons-beanutils:1.11.0"
*** End Patch
For reference: rule CVE-2025-48734. Rated high.
I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
maestro-engine/gradle.lockfilearound line 42 that looked worth flagging.The project uses Apache Commons BeanUtils 1.9.4, which is vulnerable to CVE‑2025‑48734. An attacker can supply a crafted property path to PropertyUtilsBean.getProperty() and read the enum's "declaredClass" property, exposing the ClassLoader and enabling arbitrary code execution. This is a HIGH‑severity issue because it allows remote code execution through uncontrolled input. Upgrading to version 1.11.0 (or later) makes the BeanIntrospector suppress the dangerous property by default, fully mitigating the risk.
Something like this might fix it:
For reference: rule
CVE-2025-48734. Rated high.I do not maintain this project, so I may well be missing context — if this is intentional or already handled elsewhere, please just close it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.