Technical impact
A vulnerability in the JuelScriptEngine.eval function allows an attacker to inject arbitrary code through a manipulated input. The flaw falls under CWE‑74 (Code Injection) and CWE‑94 (Improper Eval/Execution), enabling remote execution of attacker‑supplied scripts. The exploit can be triggered from a network‑reachable endpoint, meaning an unauthenticated external attacker could run malicious code on the affected system.
Affected Systems
Alfresco Activiti versions up to 7.21.0‑rc.692 are affected. The issue resides in the Activiti component of Alfresco, which provides business process management and workflow capabilities.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, but the nature of code injection and remote trigger elevates practical risk, especially since no official patch or KEV listing is available. The lack of an EPSS score suggests insufficient public exploitation data, but the theoretical ability to execute arbitrary code remains significant. Assessing environment exposure and whether the vulnerable component is reachable from untrusted networks is advisable.
