CedarJava is an open‑source Java implementation of the Cedar policy language. In versions before 2.3.6, 3.4.1, and 4.9.0, the toCedarExpr() method on Cedar Value types fails to escape quotation marks and backslashes when converting values to Cedar source code. This lack of escaping can allow Cedar expression injection when an integrator uses toCedarExpr() to build policy text at runtime from user‑controlled values, under certain circumstances. For example, injecting || true into a permit clause can make that permit unconditional, or inserting && false into a forbid clause can negate the forbid. Such injection enables an actor to alter policy logic and bypass intended authorization controls. This flaw is a code‑injection vulnerability (CWE‑94).

Vendors: The CedarPolicy project provides the CedarJava library. The flaw impacts all releases prior to 2.3.6, 3.4.1 and 4.9.0; newer releases contain the fix.

The CVSS score of 8.8 marks this as a high‑severity vulnerability, indicating a potential for significant impact if exploited. The EPSS score of < 1 % suggests a low probability of real‑world exploitation at the time of analysis, and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would occur through application integration, where an attacker supplies crafted user input to a component that invokes toCedarExpr() to construct policy text dynamically. When successful, the injected Cedar expressions can modify policy logic to grant or deny access in ways that bypass intended security controls.