CVE-2023-34112

MediumCVSS 4.3

Published: 09/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.95%

78th percentile - higher than 78% of all known CVEs

Summary

JavaCPP Presets uses the `github.event.head_commit.message` parameter insecurely, leading to a command injection vulnerability. This issue has been addressed in version 1.5.9.

Risk Assessment

Organizations using JavaCPP Presets may be exposed to command injection attacks, potentially leading to unauthorized access or execution of harmful commands.

Recommendation

It is recommended to upgrade to version 1.5.9 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.