{"id":"CVE-2023-34112","aliases":["EUVD-2023-38214","GHSA-36rx-hq22-jm5x"],"status":"published","title":"JavaCPP project actions vulnerable to code injection","description":"JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0195,"percentile":0.80373,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2023-06-08T23:05:36Z","modified":"2026-10-28T02:30:42Z","products":[{"vendor":"bytedeco","product":"javacpp-presets"},{"vendor":"bytedeco","product":"javacpp_presets"}],"references":[{"url":"https://github.com/bytedeco/javacpp-presets/security/advisories/GHSA-36rx-hq22-jm5x","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://securitylab.github.com/research/github-actions-untrusted-input/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34112.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34112","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-34112","title":"JavaCPP project actions vulnerable to code injection  ","description":"JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.","status":"published","published":"2023-06-08T23:05:36.423Z","modified":"2025-01-06T19:43:42.532Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:35.912488Z"}],"euvd":[{"id":"EUVD-2023-38214","description":"JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.","status":"published","published":"2023-06-08T23:05:36Z","modified":"2025-01-06T19:43:42Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:25.174818Z"}],"nvd":[{"id":"CVE-2023-34112","description":"JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.","status":"published","published":"2023-06-09T00:15:10.447Z","modified":"2026-06-17T06:02:55.273Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:08:05.329837Z"}],"osv":[{"id":"CVE-2023-34112","title":"JavaCPP project actions vulnerable to code injection  ","description":"JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.","status":"published","published":"2023-06-08T23:05:36.423Z","modified":"2026-10-28T02:30:42.659388912Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:32.116263Z"}]}}