CVE-2019-1010260
High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
CVE-2019-1010260- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-319
- Updated
- 2026-11-02
CVE List No score
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
CVE-2019-1010260- Updated
- 2026-11-02
EUVDEUVD-2019-0433 No score
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
EUVD-2019-0433- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r8h9-hq9c-2p5c
High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
GHSA-r8h9-hq9c-2p5c- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
OSV
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
CVE-2019-1010260- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-r8h9-hq9c-2p5c
High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
- Record
GHSA-r8h9-hq9c-2p5c- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-319
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.github.shyiko.ktlint:ktlint-coreMaven |
before 0.30.0 | 0.30.0 |
com.github.shyiko.ktlint:ktlint-coreMaven |
before 0.30.0, plus listed versions 0.10.00.10.10.10.20.11.00.11.1 Show 44 moreShow less0.12.00.12.10.13.00.14.00.15.00.15.10.16.00.16.10.17.00.17.10.18.00.19.00.2.00.2.10.2.20.20.00.21.00.22.00.23.00.23.10.24.00.25.00.25.10.26.00.27.00.28.00.29.00.3.00.3.10.4.00.5.00.5.10.6.00.6.10.6.20.7.00.7.10.8.00.8.10.8.20.8.30.9.00.9.10.9.2 |
0.30.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1010260 is a high vulnerability (CVSS 8.1) in Ktlint, published April 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in com.github.shyiko.ktlint:ktlint-core 0.30.0.