CVE-2024-31861
Code injection in Apache Zeppelin Shell
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
What each source reports
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2024-31861- Updated
- 2026-11-02
EUVDEUVD-2024-1163 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
EUVD-2024-1163- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8pfj-w89w-m24x No score
Code injection in Apache Zeppelin Shell
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.
- Record
GHSA-8pfj-w89w-m24x- Weakness
- CWE-94
- Updated
- 2026-11-02
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2024-31861- Updated
- 2026-11-02
OSVGHSA-8pfj-w89w-m24x No score
Code injection in Apache Zeppelin Shell
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.
The attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way. This issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.
Users are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.
- Record
GHSA-8pfj-w89w-m24x- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.zeppelin:zeppelin-shellMaven |
0.10.1 up to 0.11.1 | 0.11.1 |
org.apache.zeppelin:zeppelin-shellMaven |
0.10.1 up to 0.11.1, plus listed versions 0.11.0 |
0.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31861 has been rejected by its source and should not be treated as a live vulnerability, published April 11, 2024. Fixed in org.apache.zeppelin:zeppelin-shell 0.11.1.