JeecgBoot v3.9.2 contains a flaw in the AI Flow module's CodeNode component that permits execution of arbitrary Groovy scripts. The SecurityCheck class attempts to block dangerous calls by using a blacklist, but the dynamic capabilities of Groovy allow this filter to be bypassed through string concatenation and reflection, enabling an attacker to run arbitrary system commands. The CVE description does not explicitly state confidentiality or availability effects, so those impacts are not confirmed in the data provided.

The affected product is JeecgBoot version 3.9.2, specifically the AI Flow module, CodeNode component that supports Groovy script execution. No further vendor or product variants are listed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. No CVSS score is supplied, so a quantitative severity cannot be assigned. To exploit the vulnerability, an attacker would need the ability to submit Groovy code to the AI Flow endpoint or another input that triggers script execution. Bypassing the blacklist requires only manipulating the script payload, so the exploitation complexity is low. Because the flaw enables full command execution on the host, it represents a high inherent risk once the attack vector is attained.