CRITICAL9.8
GHSA-8gqp-hr9g-pg62
Conductor vulnerable to OS command injection through unrestricted access to Java classes
Quick fix
GHSA-8gqp-hr9g-pg62 — org.conductoross:conductor-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>3.21.13</version> for org.conductoross:conductor-coreDetails
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.conductoross:conductor-core
Introduced in:
0Fixed in: 3.21.13Fix
# pom.xml: bump <version>3.21.13</version> for org.conductoross:conductor-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2025-26074[ADVISORY]
- https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b[WEB]
- https://github.com/conductor-oss/conductor[PACKAGE]
- https://github.com/conductor-oss/conductor/blob/main/core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java[WEB]
- https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb[WEB]