Open-source package vulnerability · Maven
CVE-2025-59059: Apache Ranger has a Code Injection vulnerability
criticalCVSS 3.1 9.8GHSA-c87w-642h-m97h
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0. Users are recommended to upgrade to version 2.8.0, which fixes this issue.
Published Mar 3, 2026 · Updated Mar 4, 2026
Affected packages
org.apache.ranger:ranger-plugins-common
- Ecosystem
- Maven
- Affected
- < 2.8.0
- Fixed in
- 2.8.0
- Check
mvn dependency:tree -Dincludes=org.apache.ranger:ranger-plugins-common
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions <= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology