UYAP Document Editor Insecure Deserialization Enables Remote Code Execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
CWE-502 deserialization of untrusted data in the Ministry of Justice General Directorate of Information Technology's UYAP Document Editor allows object injection. The flaw affects the Windows and Linux builds before 5.4.20 and the MacOS builds before 5.4.21. The CVSS 3.1 base score is 8.8 (HIGH), with a network attack vector, no privileges required, user interaction required, and high impact to confidentiality, integrity and availability. CISA has not added it to KEV, and the references contain no exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ministry of Justice General Directorate of Information Technology | UYAP Document Editor | before 5.4.20 | 5.4.20 | Patch available | CNA |
| Ministry of Justice General Directorate of Information Technology | UYAP Document Editor | before 5.4.21 | 5.4.21 | Patch available | CNA |
- UYAP Document Editor VendorMinistry of Justice General Directorate of Information Technology Affected before 5.4.20 Fixed in 5.4.20 Patch available CNA
- UYAP Document Editor VendorMinistry of Justice General Directorate of Information Technology Affected before 5.4.21 Fixed in 5.4.21 Patch available CNA
Remediation
Upgrade to version 5.4.20 on Windows and Linux, and to version 5.4.21 on MacOS, which fix the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA UYAP Document Editor (Ministry of Justice General Directorate of Information Technology) Fixed in 5.4.20
- Fix · CNA UYAP Document Editor (Ministry of Justice General Directorate of Information Technology) Fixed in 5.4.21
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Ministry of Justice General Directorate of Information Technology UYAP Document Editor 5.4.20, 5.4.21
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-70973 OS command injection in Ministry of Justice UYAP Document EditorPriority LOW 37
Timeline
- 2026-10-12 Threatist record created from CVE-2026-12613
- 2026-10-12 Alias added: GHSA-m3wc-m3g8-wx7q
- 2026-10-12 CISA SSVC decision points changed
- 2026-10-12 Priority changed: MEDIUM → LOW
- 2026-10-13 Priority changed: LOW → MEDIUM
- 2026-10-14 Fix available: Ministry of Justice General Directorate of Information Technology/UYAP Document [email protected] · CNA
References
More Ministry of Justice General Directorate of Information Technology vulnerabilities
- TI-2026-70973 OS command injection in Ministry of Justice UYAP Document Editor CVSS 3.1HIGH 7.8
Sources
- CVE-2026-12613 · CVE Program
- CVE-2026-12613 · NVD
- FIRST EPSS
- GHSA-m3wc-m3g8-wx7q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences