CVE-2025-0982

CRITICAL

10.0

Description

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.

CVE Details

CVSS v3.1 Score10.0

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/6/2025

Last Modified7/30/2025

Sourcenvd

Honeypot Sightings0

Affected Products

google:application_integration

Weaknesses (CWE)

CWE-829CWE-829

References

https://cloud.google.com/application-integration/docs/release-notes#January_23_2025(cve-coordination@google.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.