Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
Priority MEDIUM 51CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Why it matters now
EPSS 0.06029 93rd percentileScored 2026-11-07
Fix Fixed Apache ShenYu (incubating) (Apache Software Foundation): 2.4.2org.apache.shenyu:shenyu-common (Maven): 2.4.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache ShenYu (incubating) | Apache ShenYu (incubating) to before 2.4.2 | 2.4.2 | Patch available | CNA |
| — | org.apache.shenyu:shenyu-common (Maven) | 2.4.0 to before 2.4.2 | 2.4.2 | Patch available | GHSA-gh38-x2wm-xmc8 |
- Apache ShenYu (incubating) VendorApache Affected Apache ShenYu (incubating) to before 2.4.2 Fixed in 2.4.2 Patch available CNA
- org.apache.shenyu:shenyu-common (Maven) Vendor— Affected 2.4.0 to before 2.4.2 Fixed in 2.4.2 Patch available GHSA-gh38-x2wm-xmc8
Remediation
- Fix · CNA Apache ShenYu (incubating) (Apache Software Foundation) Fixed in 2.4.2
- Fix · GHSA-gh38-x2wm-xmc8 org.apache.shenyu:shenyu-common (Maven) Fixed in 2.4.2 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Apache ShenYu (incubating) 2.4.2
4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-07916 Apache ShenYu 2.4.1 Improper access controlPriority HIGH 79
- TI-2022-07364 Apache ShenYu Password leakagePriority MEDIUM 40
- TI-2022-07917 Apache ShenYu missing authentication allows gateway registrationPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2021-45029
- 2026-10-03 Alias added: GHSA-gh38-x2wm-xmc8
References
Advisory 4
- https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639
- [oss-security] 20220125 CVE-2021-45029: Groovy Code Injection & SpEL Injection in Apache ShenYu 2.4.1
- [oss-security] 20220126 CVE-2021-45029: Apache ShenYu (incubating) Groovy Code Injection and SpEL Injection
- https://nvd.nist.gov/vuln/detail/CVE-2021-45029
More Apache Shenyu vulnerabilities
- TI-2022-07916 Apache ShenYu 2.4.1 Improper access control CVSS 3.1CRITICAL 9.1
- TI-2021-15467 Apache ShenYu Admin bypass JWT authentication CVSS 3.1CRITICAL 9.8
- TI-2022-20760 Apache ShenYu Admin ultra vires CVSS 3.1HIGH 8.8
- TI-2022-17499 Apache ShenYu Admin Improper Privilege Management CVSS 3.1HIGH 8.8
- TI-2022-07364 Apache ShenYu Password leakage CVSS 3.1HIGH 7.5
- TI-2022-07917 Apache ShenYu missing authentication allows gateway registration CVSS 3.1HIGH 7.5
Sources
- CVE-2021-45029 · CVE Program
- CVE-2021-45029 · NVD
- FIRST EPSS
- GHSA-gh38-x2wm-xmc8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences