The vulnerability allows an attacker to inject arbitrary JEXL code into the Nutch REST API, leading to execution of arbitrary system commands. Because the API endpoint lacks authentication checks, the flaw can be exploited by any network user with access to the service, granting complete compromise of the host where Nutch runs. The weakness is defined by improper control of dynamically generated code and unsafe reflection, making the impact severe.

Apache Nutch versions 1.11 through 1.22 are affected. The flaw resides in the Nutch Server component that exposes the REST API for search and indexing functions. Over the same version range, the Nutch Server remains a public-facing service.

The failure to authenticate and the ability to remotely inject commands mean that the attack vector is likely the REST API endpoint accepting JEXL expressions. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of active exploitation yet. However, the lack of authorization coupled with code injection creates a high severity risk for any machine exposing the service.