CVE-2021-30181
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
CVE-2021-30181- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
CVE-2021-30181- Updated
- 2026-11-02
EUVDEUVD-2022-1521 No score
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
EUVD-2022-1521- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qmfc-6www-fjqw
Code injection in Apache Dubbo
Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
GHSA-qmfc-6www-fjqw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
CVE-2021-30181- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-qmfc-6www-fjqw
Code injection in Apache Dubbo
Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
- Record
GHSA-qmfc-6www-fjqw- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.alibaba:dubboMaven |
2.5.0 up to 2.6.9 | 2.6.9 |
org.apache.dubbo:dubboMaven |
2.5.0 up to 2.7.10 | 2.7.10 |
com.alibaba:dubboMaven |
2.5.0 up to 2.6.9, plus listed versions 2.5.12.5.102.5.22.5.32.5.4 Show 14 moreShow less2.5.52.5.62.5.72.5.82.5.92.6.02.6.12.6.22.6.32.6.42.6.52.6.62.6.72.6.8 |
2.6.9 |
org.apache.dubbo:dubboMaven |
2.5.0 up to 2.7.10, plus listed versions 2.7.02.7.12.7.22.7.32.7.4 Show 6 moreShow less2.7.4.12.7.52.7.62.7.72.7.82.7.9 |
2.7.10 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/apache__incubator-dubbo_CVE-2021-30181_2-6-8 | 2025-08-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-30181 is a critical vulnerability (CVSS 9.8) in Apache Dubbo, published May 29, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.9%, the 99th percentile. Fixed in com.alibaba:dubbo 2.6.9.