This vulnerability involves improper deserialization of untrusted data within the JavaScript Task component of Google Cloud Application Integration. The flaw allows an attacker who is authenticated with standard permissions to supply a crafted script that bypasses parameter guards and forces execution of arbitrary code on the shared production servers. The effect is the ability for the attacker to run code with the same privileges as the application integration context, potentially compromising confidentiality, integrity, and availability of the impacted environment.

Google Cloud Application Integration is affected in all revisions before 2026-06-28. The issue exists in the default deployment configuration that processes JavaScript Tasks. Any customer who employs custom JavaScript code in the integration flow on GCP is at risk until the patch issued on 28 June 2026 is applied. No other vendors or products are listed as affected.

The CVSS score for this vulnerability is 9.4, indicating critical severity. The EPSS score is not available, but the lack of a published exploit in the KEV catalog suggests no known large‑scale exploitation. However, the attack requires only standard authenticated access to the integration service, making the threat plausible for any user with legitimate permissions. Since the flaw permits arbitrary code execution on shared servers, the potential damage is considerable. The recent patch release on 28 June 2026 eliminates the vulnerability, and no operational changes are required thereafter.