Description
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
Remediation
References
https://github.com/xuxueli/xxl-job/issues/2979
Related Vulnerabilities
CVE-2022-25940 Vulnerability in npm package lite-server
CVE-2022-21718 Vulnerability in npm package electron
CVE-2023-40348 Vulnerability in maven package org.jenkins-ci.plugins:gogs-webhook
CVE-2022-0219 Vulnerability in maven package io.github.skylot:jadx-core
CVE-2020-13973 Vulnerability in maven package com.mikesamuel:json-sanitizer