A single ScriptEngine instance is reused for every message in a script‑backed channel. For JSR‑223 engines that report THREADING=null, such as the Kotlin kts engine, concurrent message processing can corrupt the engine’s internal state. This corruption may cause one message’s payload and headers bindings to appear in another message’s script evaluation or trigger spurious exceptions, exposing sensitive information between otherwise unrelated messages.

Spring Integration library versions 7.1.0, 7.0.0–7.0.5, 6.5.0–6.5.10, 6.4.0–6.4.12, and 5.5.21 or earlier by the Spring vendor.

The CVSS score of 4.2 indicates moderate severity, and the EPSS score is < 1%, indicating a low likelihood of exploitation, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an actor to send messages that traverse the affected script channel, which may be possible through external interfaces or internal application logic. The potential for data leakage or service disruption warrants attention.