The vulnerability is an improper control of dynamically-loaded code in Apache Juneau. During parsing, a value assigned to a java.lang.Class property causes the application to load and initialize the named class, executing its static initializer unconditionally. This can lead to arbitrary code execution if the attacker supplies the name of a class that performs malicious actions during initialization.

Affected are users of Apache Juneau up to and including version 9.2.0, regardless of operating system or deployment environment. The product is the Apache Juneau framework distributed by the Apache Software Foundation.

The CVSS score of 10 indicates the severity of potential remote code execution. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of exploitation data does not reduce its risk. The likely attack vector is remote: an attacker can craft input that names a class present on the application classpath, causing the framework to load that class during parsing and execute its static initializer. The impact depends on the classes available to the deployment, but any malicious static initializer could compromise confidentiality, integrity, or availability of the host system.