Read the docs
TI-2026-25227 Aliases CVE-2026-32735

Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`

Priority LOW 12CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project (`openapi-to-java-records-mustache-templates-parent`), which is used to centralize plugin configurations for multiple unit-test modules, uses `maven-dependency-plugin` to unpack arbitrary `.mustache` files from the `openapi-to-java-records-mustache-templates` artifact (of the same version). While this parent POM file is not intended for external use, it is published, and could be used by anyone, and does not follow the best security practices. The risk, is that if `openapi-to-java-records-mustache-templates` would be compromised, and malicious `.mustache` files were to be included in the resulting JAR/artifact, users would unpack these files automatically during a dependency update. This is addressed in the v3.5.1 release of `openapi-to-java-records-mustache-templates-parent`. It is strongly recommended NOT to use the parent POM for external use. The `openapi-to-java-records-mustache-templates` module is the center of this project, and surrounding modules and configurations are not intended for production-use. These only exist for testing purposes and maintainability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed io.github.chrimle:openapi-to-java-records-mustache-templates-parent (Chrimle): 3.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Chrimleio.github.chrimle:openapi-to-java-records-mustache-templates-parent3.1.1 to before 3.5.13.5.1Patch availableCNA
  • io.github.chrimle:openapi-to-java-records-mustache-templates-parent VendorChrimle Affected 3.1.1 to before 3.5.1 Fixed in 3.5.1 Patch available CNA

Remediation

  • Fix · CNA io.github.chrimle:openapi-to-java-records-mustache-templates-parent (Chrimle) Fixed in 3.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32735

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences