The Pentaho Data Integration and Analytics platform includes an H2 database JDBC driver that is susceptible to external script execution when a data source administrator establishes a new connection. This flaw allows an attacker who can become an administrator or gain their credentials to run arbitrary code on the host system, potentially taking full control. The weakness is a command injection vulnerability, identified as CWE-1395.

All versions of Hitachi Vantara Pentaho Data Integration and Analytics contain the vulnerable H2 JDBC driver, meaning any deployment—regardless of version—remains susceptible until the driver is removed or patched.

The CVSS score of 9.1 signals a severe vulnerability. The EPSS score is 0.00085, indicating a very low exploitation probability. The absence from the CISA KEV catalog suggests no widespread, active exploitation has been observed. The likely attack vector is local; an attacker who can assume or steal a data source administrator role can trigger the flaw during new connection creation. While remote exploitation would require the attacker to first authenticate as an administrator, once privileged, the ability to execute system commands is granted. No exploit code was reported but the high severity warrants immediate action.