GHSA-2gh6-wc3m-g37f: hermes-management is vulnerable to RCE due to Apache commons-jxpath
Impact hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath. Patches Upgrade Hermes to at least hermes-2.2.9 References https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/
Published Sep 17, 2024 · Updated Aug 31, 2026
Affected packages
pl.allegro.tech.hermes:hermes-management
- Ecosystem
- Maven
- Affected
- >= 0.8.2, < 2.2.9
- Fixed in
- 2.2.9
- Check
mvn dependency:tree -Dincludes=pl.allegro.tech.hermes:hermes-management
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.
Patches
Upgrade Hermes to at least hermes-2.2.9
References
https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/
Credited to sealbenb.
References
- https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f
- https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1
- https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852
- https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31
- https://github.com/advisories/GHSA-2gh6-wc3m-g37f
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology