Jeecg Boot is vulnerable to a code injection flaw that lets an attacker execute arbitrary commands on the server. The weakness stems from insufficient character filtering in user‑supplied input, allowing specially crafted HTTP requests to be treated as executable code within the Java Virtual Machine. Compromise would grant full control over that instance, jeopardizing all data and services handled by the application.

This vulnerability affects Jeecg Boot releases from version 3.0.0 through 3.5.3, inclusive. Any deployment of these versions that is reachable via HTTP is potentially exposed. No other products or earlier or later versions are currently known to be impacted.

The baseline CVSS score of 9.8 indicates extremely high severity, while the EPSS score below 1% suggests a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a crafted HTTP request to a vulnerable endpoint; the description does not specify required authentication, so the endpoint could be publicly accessible or may require valid credentials. In either case, an attacker can execute arbitrary code remotely if the endpoint is reachable.