GHSA-3qpm-h9ch-px3c
Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser. It's well detailed at CVE-2021-44228 and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).
Impact
Malicious client code could be used to send messages and cause remote code execution on the server.
Patches
PowerNukkit 1.5.2.1 is a patch-release that only updates the Log4j version to 2.17.0 and should be used instead of 1.5.2.0.
All versions prior to 1.5.2.1 are affected and are not patched.
Workarounds
If you can't upgrade, you can use the -Dlog4j2.formatMsgNoLookups=true startup argument as remediation, as this prevents the vulnerability from happening.
References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/advisories/GHSA-p6xc-xr62-6r2g
For more information
If you have any questions or comments about this advisory:
- Open an issue in the PowerNukkit repository
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser. It's well detailed at CVE-2021-44228 and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).
Impact
Malicious client code could be used to send messages and cause remote code execution on the server.
Patches
PowerNukkit 1.5.2.1 is a patch-release that only updates the Log4j version to 2.17.0 and should be used instead of 1.5.2.0.
All versions prior to 1.5.2.1 are affected and are not patched.
Workarounds
If you can't upgrade, you can use the -Dlog4j2.formatMsgNoLookups=true startup argument as remediation, as this prevents the vulnerability from happening.
References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/advisories/GHSA-p6xc-xr62-6r2g
For more information
If you have any questions or comments about this advisory:
- Open an issue in the PowerNukkit repository
- Record
GHSA-3qpm-h9ch-px3c- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20, CWE-400, CWE-502
- Updated
- 2026-11-02
OSV
Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser. It's well detailed at CVE-2021-44228 and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).
Impact
Malicious client code could be used to send messages and cause remote code execution on the server.
Patches
PowerNukkit 1.5.2.1 is a patch-release that only updates the Log4j version to 2.17.0 and should be used instead of 1.5.2.0.
All versions prior to 1.5.2.1 are affected and are not patched.
Workarounds
If you can't upgrade, you can use the -Dlog4j2.formatMsgNoLookups=true startup argument as remediation, as this prevents the vulnerability from happening.
References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/advisories/GHSA-p6xc-xr62-6r2g
For more information
If you have any questions or comments about this advisory:
- Open an issue in the PowerNukkit repository
- Record
GHSA-3qpm-h9ch-px3c- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20, CWE-400, CWE-502
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.powernukkit:powernukkitMaven | through 1.5.2.0 | 1.5.2.1 |
org.powernukkit:powernukkitMaven | before 1.5.2.1, plus listed versions 1.1.1.0-PN1.1.1.1-PN1.2.0.0-PN1.2.0.2-PN1.2.1.0-PN Show 14 moreShow less1.3.0.1-PN1.3.1.1-PN1.3.1.2-PN1.3.1.3-PN1.3.1.4-PN1.3.1.5-PN1.3.2.0-PN-ALPHA.21.3.2.0-PN-ALPHA.31.4.0.0-PN1.4.0.0-PN-ALPHA.11.4.0.0-PN-ALPHA.21.5.0.0-PN1.5.1.0-PN1.5.2.0-PN | 1.5.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-3qpm-h9ch-px3c is a critical vulnerability (CVSS 10.0) in org.powernukkit:powernukkit, published January 6, 2022. No source lists public exploit code. Fixed in org.powernukkit:powernukkit 1.5.2.1.